Reported ransomware incidents are just the tip of the iceberg | Daily Reports Online
The intense scrutiny that organizations face after highly publicized ransomware attacks has become one of the defining features in this era of cyberattacks, as regulators, customers and shareholders all look for answers.
The consequences are often highly visible and public attention can last for months; from schools forced to close down, manufacturers halting production lines and healthcare providers racing against the clock to restore services for patients.
CEO and Founder of BlackFog.
Yet these widely reported attacks represent only a small fraction of the overall threat.
The reality is far more extensive as the daily onslaught of ransomware attacks extends across every sector and size of organization.
This is because attackers are motivated principally by one thing: the value and presence of the company’s data.
The disclosure gap
The extent of ransomware attacks taking place under the radar is growing. From our own research tracking ransomware activity, we discovered 7,079 undisclosed attacks in 2025, accounting for 86% of all attacks that year. This represented a sharp rise of 37% rise compared with the previous year.
While everyone knows ransomware is a threat, these blind spots present a problem. It means Boards and security leaders are making risk decisions without knowing the real threat level, whilst regulators are developing policies and regulations based on seeing a fraction of the problem. Tracking trends, sharing information and understanding the full extent of the threat is vital for shaping the strategies and solutions that protect against this fast-changing and highly evolved ransomware criminal ecosystem.
Regulatory frameworks are clear on an organization’s responsibilities when it comes to reporting incidents that impact essential services and breaches that involve personal data. Under the GDPR, organizations are required to disclose personal data breaches within 72 hours, and the ICO also recommends that law enforcement is advised.
Nevertheless, a breach that reaches the public eye means damaging publicity, questions from shareholders and customers venting their frustration. Set this brand damage against the option of paying the ransom quietly and organizations may attempt to resolve incidents without public disclosure.
The changing tactics of ransomware groups may also contribute to an organization’s response. Data encryption forced companies’ hands – systems stopped working, people noticed and hiding it was impossible. However, data exfiltration – which now happens in the vast majority of attacks – works differently as payments could be made without anyone outside the building even knowing.
The policy and defense blind spots this creates
The gap between what’s happening in the real world and what gets reported matters for several reasons. When a regulatory framework is built on incomplete data, entire industries may underestimate their exposure because they’re only seeing a proportion of what’s happening.
The consequences extend beyond policy. Threat intelligence sharing, which relies on organizations reporting what they’ve seen, breaks down when most incidents stay secret. Cybersecurity vendors develop defenses against the attacks they know about, while critical information on tactics, techniques and procedures remain in the shadows.
When such a large proportion of these attacks goes unreported, the security industry struggles to track how quickly adversaries are advancing and we’re fighting an enemy we can only partially observe. This is particularly significant at a time when AI has entered the picture with attackers able to speed up reconnaissance, find vulnerabilities and scale their operations faster than any manual work could achieve.
Building transparency and mitigating the impact
Fixing this requires changes to both law and culture and the goal should be giving policymakers and security teams the information they need.
Change is coming, with proposals for new legal requirements to strengthen incident reporting obligations. In the UK, the government has consulted on reforms that would require businesses to report ransomware incidents within 72 hours. While it remains unclear whether this will apply to all ransomware incidents, organizations should begin preparing now to ensure they can identify and report incidents promptly and effectively.
This focus better reflects modern ransomware, where data theft often causes more damage than downtime, and these new requirements will bring more incidents into the open.
Information sharing within industries needs to improve as well. The logic is straightforward; when attacks stay hidden, everyone becomes more vulnerable, especially when ransomware groups keep evolving their methods and attackers get faster at what they do. The longer we operate on incomplete information, the further behind we fall.
Whilst the threat across all industries and organizations remains high, businesses must continue to focus on protections to boost resilience, rather than waiting until regulations force them to take action.
This means preventing systems from being compromised through strict access controls and stopping sensitive data from leaving the network through measures like anti data exfiltration (ADX). Ultimately the goal must be to avoid becoming a target in the first place and being forced to make decisions on negotiation, payment to attackers and the regulatory requirements that follow on from a data breach.
With criminals’ intent on data theft as leverage for extortion, the best defensive strategy is to make your organization a hard target and minimize the risk of being the next victim of an attack that puts you under the microscope of regulators, media and the wider public.
We’ve Reviewed, Rated, and Ranked The Best Firewall Software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
