Ransomware trackers flag late‑2025 surge hitting healthcare, engineering, construction

Ransomware.live, a widely monitored tracker operated by security researcher Julien Mousqueton, published a real‑time summary showing a concentrated wave of ransomware and infostealer activity affecting engineering firms, medical service providers and related sectors, as Comparitech data tallied 5,186 ransomware attacks in 2025 — a 36 percent increase from 2024.

The spike included heavy pressure on health systems. Comparitech’s year‑to‑date dataset counts 445 attacks against healthcare providers and 191 against healthcare‑related businesses, for a combined 636 ransomware incidents in the sector through 2025. Among provider incidents, 155 were listed as confirmed and were associated with more than 10.1 million breached records; across the healthcare sector Comparitech estimates more than 16.5 million records were exposed, with the caveat that disclosures are still emerging.

Health‑ISAC, which aggregates member reporting, recorded 190 ransomware attacks against the health sector in the fourth quarter of 2025 — the highest quarterly total of the year — and counted 575 health‑sector‑specific cyber incidents for 2025, up from 476 in 2024. Health‑ISAC issued 183 targeted alerts to members in Q4 tied to two significant vulnerabilities; the first involved Ivanti Endpoint Manager in December.

The shape of the year was uneven. Comparitech and Health‑ISAC data show attacks fell through much of 2025 before jumping in the second half, with a roughly 50 percent increase in healthcare attacks in Q4. Industry reporting also shows sectoral differences: manufacturing experienced sharp gains earlier in the year while education rose modestly and government remained steady.

A notable change in economics accompanied the surge. Comparitech reported that average ransom demands in healthcare fell to $615,000 in the reported period, down 84 percent from a $3.9 million average in 2024. Security trackers also pointed to a cluster of active strains hitting providers, naming Qilin, INC, SafePay, Sinobi and Medusa, with Qilin responsible for the highest number of confirmed attacks.

Geographically, the Comparitech healthcare dataset shows the United States as the most affected country, followed by Australia, the United Kingdom, Germany, France and Canada. Trackers differentiate between claims posted on extortion sites and confirmed incidents; Comparitech and other aggregators flag a smaller subset of confirmed events within larger claim totals.

Longer term context underscores the stakes. A comprehensive analysis of PHI breaches from 2010 to 2024 found patient records affected rose from 6 million in 2010 to 170 million in 2024, and concluded that ransomware accounted for a large and growing share of stolen records. The study cautions that published figures likely understate the true scope because of underreporting and regulatory thresholds that exclude smaller breaches.

Researchers and health system defenders say the late‑year rise, the volume of exposed records and the mix of targeted vulnerabilities point to an active and evolving threat environment. Differences in tracking methods mean published totals are not directly interchangeable, but the convergence of real‑time trackers, Comparitech counts and Health‑ISAC alerts signals an operationally significant wave that disrupted engineering, healthcare and construction firms and put millions of patient records at increased risk.