The FBI’s latest Internet Crime Report, published in April 2026, shows ransomware is still one of the most damaging threats to American businesses. Here is what the 2025 figures say, and what to do in the first hour if it happens to you.
What the FBI’s 2025 figures show
- 3,611 ransomware complaints were reported to the FBI’s Internet Crime Complaint Center (IC3) in 2025, across all sectors.
- More than 2,100 of those were attacks on US critical infrastructure. Health care and public health reported the most.
- Reported losses were over $32 million, but the FBI says the real cost is much higher. That figure doesn’t include downtime, recovery costs or other lost business, and it leaves out attacks reported directly to FBI field offices.
- The most reported ransomware groups were Akira, Qilin and Lynx. All three rent out their tools to other criminals, and all use “double extortion”: they encrypt your files and also threaten to publish stolen data.
Why the reported losses look small
The losses victims report are mostly the money paid out. For most businesses the bigger cost is days or weeks without access to their systems: staff who can’t work, orders that can’t ship and customers who go elsewhere. Getting the data back quickly matters more than anything else.
The first hour after an attack
- Disconnect, don’t shut down. Unplug network cables and turn off Wi-Fi on affected machines. Leave servers running unless the encryption is still spreading.
- Keep the evidence. Don’t delete encrypted files, ransom notes or logs, and don’t reinstall anything. They are what recovery is built from.
- Don’t contact the attackers yet. Talk to us first. Many businesses get their data back from backups, snapshots and unencrypted areas without paying.
- Report it. The FBI asks victims to report ransomware at ic3.gov.
We help businesses recover from ransomware on-site across Los Angeles, the Inland Empire and Ventura County, and by mail-in from anywhere in the US. You get a fixed quote before any recovery work starts, and we always work from a copy, never your only original.
Sources
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)
- GovTech, 14 April 2026: FBI: Ransomware still a top threat to critical infrastructure