"Ransomware is an extortion racket, and the people behind it are as caring as the Kray twins"

Guilty: it's another column about ransomware, but this one is different as Davey asks whether the government is right to ban ransom payments

- DAVEY WINDER

Given the mass media coverage of ransomware attacks on first the UK high street and then the US retail sector, you'd be forgiven for thinking that ransomware is public cyber enemy number one. Now, don't get me wrong, it's a massive problem that has enormous potential for harm to business, but it's far from the only thing you should be focused on. Especially when you realise that rather than being on the rise, ransomware is actually in decline.

I'm not talking about the fall of major criminal groups that have dominated the threat sector in the past; they’re always replaced by others or by themselves. The disbanded groups splinter and make new alliances, form new groups or simply change their name, tweak the malware, establish new infrastructure and it’s business as usual. Take the example of the ransomware group behind those attacks on Marks and Sparks and the Coop: Scattered Spider, or more loosely The.Com collective, which emerged after the fall of ALPHV (Black Cat).

No, what I'm talking about is a decline in the threat itself. NCC Group (nccgroupplc.com) publishes a monthly “Threat Pulse” that demonstrates this using cold, hard, real-world facts. The June 2025 review was the latest available as I write this, and it found that in Q2 of the year, ransomware attacks have fallen by 43% compared to the first quarter. While the vast majority (79%) of the attacks that did happen targeted Europe and North America, the decline has been attributed to a combination of religious holidays and increased law enforcement disruption. Europe, however, had fewer than half the attacks recorded across North America, representing an 8% drop in June.