Ransomware attacks peaked in December

NCC Group recorded 574 ransomware victims in December 2024, the highest monthly total observed since the company began tracking ransomware leak-site activity in 2021. The result was unusual because December had historically produced a seasonal decline in recorded activity.

FunkSec was the most active group during the month, accounting for more than 100 claims and roughly 18% of the total. Cl0p, Akira, and RansomHub followed. More than half of the recorded cases affected organizations in North America, while the industrial sector was the most frequently listed target, ahead of consumer discretionary, information technology, financial services, and healthcare.

The figures indicate a sharp year-end increase in extortion activity, but they should be read as observed ransomware claims rather than a complete count of independently confirmed intrusions. Even with that limitation, the report shows why organizations should maintain resilient backups, tested incident-response procedures, strong identity controls, and monitoring that continues through holiday periods.

Original sources

NCC Group — December 2024 Monthly Threat Pulse

SecurityWeek — Record Number of Ransomware Attacks in December 2024

Independently summarized and reviewed by CNB Telecom.