TrustForge.pub

Authors: Yassine El Hadi & Paul Gedeon

Today, ransomware attacks are among the most damaging types of cybercrime. This threat can even lead to the downfall of organizations of a medium or large size. Malefactors take advantage of double and triple extortion by locking the data, stealing it, threatening to publish it, and at the same time pressuring the customers or partners. Due to these unforgiving tactics, ransomware has become one of the greatest risks to the sectors of energy, healthcare, finance, and government.

According to CrowdStrike’s 2025 European Threat Landscape Report, Europe alone reported 1,136 ransomware incidents in 2024, and the region now accounts for approximately 22% of global ransomware activity as of Q2 2025, based on DeepStrike 2025 Statistics.

Due to the high-risk nature related to the healthcare sector, it has become the most appealing target for sophisticated threat actors. In 2024, the Europe alone reported 289 major cyber incidents in healthcare. No other essential sector achieved a greater overall total.

Recent ransomware attacks (2024-2025)

The period of 2024 and 2025 has been marked by a series of major incidents which illustrate the systemic risk caused by sophisticated ransomware:

1. The Change Healthcare Ransomware Attack (UK, Retail, April 2025)

The attack on Marks & Spencer, in April 2025, was a wake-up call regarding the potential harm that can result when criminals target the retail sector through its supply chain. The impacted business operations on 1400 retailers, and led to a halt of the online sales, disrupted logistics, and left consumers in uncertainty. The company revealed that the total damage estimation is over £300 million for 2025/2026. The attack was carried out by the Scattered Spider group and was targeting the VMware ESXi hypervisors to paralyze the company’s core systems.

2. The Synnovis Cyber Incident (UK, Healthcare, June 2024)

On the 3rd June 2024, Synnovis, a pathology partnership between SYNLAB UK & Ireland and the NHS, was impacted by a Ransomware attack that has impacted almost all Synnovis IT systems, leading to significant interruptions in many healthcare services (which disrupted more than 10,000 appointments) and compromising both patient data and care delivery systems. King’s College Hospital confirmed that one death was directly linked to the delays caused by the incident.

The Qilin, the Russia-based cyber-criminal group responsible for the attack, has been identified as the one behind the Synnovis attack. They claimed that they carried out the cyber-attack as revenge for the UK government’s actions in an undisclosed war.

3. Supply Chain Attacks and Downstream Disruption (SE, 2025)

The supply chain weakness issue was raised again in 2025 when a devastating ransomware attack was carried out on Miljödata, a Swedish HR software provider that was used by big international companies, such as the Volvo Group. The breach impacted approximately 870,000 email addresses across Sweden’s public and private sectors. This is consistent with the obvious pattern: the criminals are increasingly focusing on Managed Service Providers (MSPs) and software vendors as their targets because it exponentially multiplies their reach. By hacking one vendor, they may be able to get into the networks of tens or even hundreds of customers using just one successful breach.

Ransomware Challenges

• Third-Party Dependency: The enormous dependence on vendors creates multiple single points of failure, which in turn leads to systemic risks that cut through whole industries. 
• Slow Incident Detection: In most cases, the attackers can be found in the network that they ultimately strike for up to several weeks, and it is only then that they go for the final stage of the operation, which is what actually triggers the huge data theft. 
• Regulatory Burden: When data is compromised, organizations are required to handle complex, time-consuming regulatory and reporting tasks that may take up to 12-18 months or even more. 
• Long-Tail Impact: The costs and legal risks that stem from forensic reviews, lawsuits, and damage to reputation, and which continue to exist long after the systems are restored, belong to the so-called long tail.

The True Damage of Modern Ransomware

Contemporary ransomware has a broader impact than just the immediate technical problem of encrypted data. It causes a ripple effect through the organization’s operations, finances, and public confidence, all three being affected at the same time. The foremost result of such a crime is the slowing down of the organization’s work, forcing it to delay some essential services. As a direct consequence, the risk to human lives increases, and the general public is endangered. At the same time, if the attack is perpetrated on national infrastructure, the heavy burden on already overstretched public services caused by the cumulative effect of the attack will turn into a matter of national security. Yet another impact that is going to be there for a while is the loss of trust by the public in the indispensable providers, such as hospitals and banks. The monetary losses could be equally as large. The organizations are exposed to the direct expenses and one of those is the money spent on the services required for the recovery, forensic investigations, and legal fees. At the same time, they also encounter some indirect effects such as the loss of revenue, damage to reputation, and the possibility of being imposed regulatory penalties. Although the ransom average had dropped slightly in 2025, the number of attacks, as well as their total cost, continued to increase. For instance, data from leak-sites revealed that the number of publicly disclosed victims in Q3 2025 was 25% higher than in Q3 2024. In 2024, 59% of organizations were victims of ransomware attacks, and the total payments made were estimated to be around $813.55 million.

Ransomware: Respond and Prevent

To protect against ransomware, a complete plan is needed, including defense-in-depth strategies, strong incident response readiness, and reliable recovery capabilities. Being well-prepared starts with the basics, making sure to have a good hygiene & hardening procedure, effective patching and vulnerability management, and most importantly, a strong identity and access management.

The key element in a ransomware-resistant architecture is the backup and recovery strategy based on regularly tested backups with offline or immutable copies, clear Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets, and well-defined runbooks for the restoration of the most important services. Incident Response Readiness is imperative; thus, having ransomware-specific playbooks and conducting regular tabletop exercises, including scenarios in which a third party is affected, are the means to accomplish this. 

Because attackers increasingly scale through software vendors and (Managed Service Provider) MSPs, supply-chain risk management is now a frontline control. Bake security requirements into contracts, define notification and cooperation timelines, validate security posture over time (not once a year), and clarify responsibilities before a crisis forces the conversation.

Finally, invest in detection and containment that matches modern attacker behavior. Endpoint Detection and Response/Extended Detection and Response (EDR/XDR) capabilities can help spot abnormal activity early (credential misuse, lateral movement, encryption-like behavior), correlate events across endpoints and identity signals, accelerate scoping, and support rapid remediation-often making the difference between a localized incident and an enterprise-wide shutdown.

Ransomware is no longer “just” a cyber incident. It is an operational and, increasingly, national resilience risk-where one breach can cascade across partners, public services, and entire sectors. The organizations that withstand it are the ones that prepare relentlessly, rehearse realistically, and engineer recovery as a core capability-not an afterthought.