Ransomware Attacks Hit Record Highs in Q3 2025: What Houston Businesses Need to Know

270 disclosed attacks, up 36% year over year, with data theft at an all-time high.

BlackFog's State of Ransomware Q3 2025 report, published in October 2025, recorded 270 publicly disclosed attacks across July through September, a 36% rise over Q3 2024. Data exfiltration appeared in 96% of those disclosed cases, the highest rate BlackFog has recorded.

The 96% figure is the one that should change how a Houston owner thinks about backups. Ransomware used to be an encryption problem: lock the files, demand payment, restore from backup, move on. That is no longer the game. When 96 of every 100 disclosed attacks involve stolen data, a clean backup restores your operations but does nothing about the copy of your client records already sitting on a criminal's server. The threat shifted from "can you recover" to "can they expose you," and those are two different defenses.

• 270 disclosed attacks, up 36%. The busiest quarter BlackFog has measured, against 198 in Q3 2024.
• 96% involved data theft. A record share, confirming that double extortion is now the default, not the exception.
• 54 ransomware groups were active. Qilin led for the second straight quarter with 20 disclosed attacks and 242 undisclosed ones.
• Roughly 40% of attacks went unattributed. Either new entrants or known groups working under fresh names, which makes threat intelligence alone an incomplete shield.

Undisclosed ransomware ran roughly six times the public count, and it climbed 21% in a quarter.

BlackFog estimates about 1,510 ransomware attacks went undisclosed in Q3 2025, a 21% increase over the same period a year earlier. That puts nearly 85% of all ransomware activity outside public view, hidden in the space between a quiet news feed and a company's actual risk.

Undisclosed does not mean minor. It means the victim settled, negotiated, or absorbed the hit without a public breach notice, which is exactly what a smaller company does when it has neither a communications team nor a legal reason to announce. BlackFog found that only 3% of undisclosed cases even carried an upfront ransom demand, because attackers increasingly steal the data first and open negotiations from a position of strength. In 35 years doing this, the businesses that get quietly extorted almost never make a report, and that silence is why owners keep assuming ransomware is somebody else's problem. It is not rarer than the headlines suggest. It is far more common, just quieter.

Healthcare alone took 86 hits, and the sector mix maps directly onto Houston's economy.

Healthcare was the most targeted sector in Q3 2025 with 86 disclosed attacks, 32% of the total, per BlackFog. Government and technology followed with 28 attacks each, so those three sectors together accounted for more than half of everything disclosed that quarter.

Read that sector list against a Houston map and the risk stops being abstract. The Texas Medical Center anchors one of the largest healthcare economies in the country, local governments across Harris and Fort Bend counties run essential services on aging systems, and the region's technology and energy vendors sit in supply chains that reach far past the city. Attackers do not pick these sectors at random. They pick data-rich targets with low tolerance for downtime, which describes a hospital, a county office, and a mid-sized law firm equally well. A smaller organization in one of those supply chains is a softer way into a bigger one, and that is often how a 40-person shop ends up on a leak site it never expected to see.

The tactic shift matters as much as the target list. Because attackers steal data before they encrypt anything, the warning signs now show up earlier and quieter: unusual outbound traffic, odd multi-factor prompts, files moving where they should not. By the time systems lock, the attacker already holds the cards. That is why detection and monitoring beat a bigger backup drive, and why the businesses that come through a ransomware attempt intact are usually the ones that caught the exfiltration, not the encryption.