Over half of Indian enterprises surveyed by OpenText faced ransomware attacks in the past year, with 71% reporting AI-driven phishing or deepfake attempts, marking India as a highly targeted region. 70% of affected organizations paid ransoms to regain data access—one of the highest global rates—yet only 12% fully recovered encrypted/stolen data, exposing a critical gap between perceived resilience and actual recovery capabilities. Attacks increasingly exploited third-party vendors or supply chains, with 63% of organizations impacted by breaches via managed service providers. Despite proactive measures like cloud security (68%), network protection (60%), and backup technologies (58%), heavy reliance on external ecosystems amplified cascading risks. The financial and operational strain was compounded by AI-enabled threats (deepfakes, voice/video spoofing), with 95% of firms allowing generative AI tools but only 50% having formal AI governance policies. Ransomware is now a board-level priority (84% of execs rank it a top-3 risk), yet recovery tests (76% conduct multi-annual drills) and employee training (80% participation) have not prevented persistent data loss and operational disruption.

Ransomware Attacks Surge in 2025, Driven by Russian-Linked Groups and AI Exploitation In 2025, ransomware attacks claimed on dark-web leak sites jumped nearly 20%, reaching 6,883 incidents, while the number of leak sites themselves grew by a third to 115, according to Bitsight’s annual "State of the Underground" report. A small group of threat actors 10 in total, half tied to Russia accounted for 58% of all attacks, highlighting a concentrated cybercriminal ecosystem. The U.S. bore the brunt of the impact, with 60% of victims located in the country, while the manufacturing sector emerged as the most targeted industry. Meanwhile, traditional data breaches declined by 41%, though Bitsight attributed the drop to reporting gaps and shifting attacker tactics rather than reduced risk. Threat actors increasingly focused on "domino-effect" targets, including critical infrastructure, defense, government, and utilities. A sectoral shift was also evident in breach trends: educational institutions suffered the most breaches (505), followed by government (475) and IT (469) a reversal from 2024, when IT led with 1,210 breaches. The report noted that breaches in 2025 were "more distributed" across industries handling PII, operational data, and supply chain assets. AI’s dual role in cybersecurity became more pronounced. While defenders leveraged AI tools, hackers increasingly exploited them, with 5.1 million mentions of Google’s Gemini, 1.4 million of OpenAI’s ChatGPT, and hundreds of thousands more for Claude and Grok on cybercrime forums. Poorly secured AI platforms also created new vulnerabilities: publicly exposed AI tools surged 360%, exceeding 1 million instances, with n8n and Open WebUI both plagued by serious flaws leading the rise. Bitsight warned that the shrinking window between vulnerability discovery and exploitation demands faster response times, as both attackers and defenders race to leverage AI for advantage. The report underscored that traditional patching schedules are no longer sufficient in this accelerated threat landscape.