December 2025 cyberattack data highlights ransomware dominance, regional attack escalation, and growing enterprise GenAI exposure entering 2026
Johannesburg, South Africa – January 14, 2025 – Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), has released its December 2025 Global Cyber Attack Statistics, revealing a cyber threat landscape increasingly defined by ransomware growth, regional concentration of cyber attacks, and rising data exposure linked to enterprise use of Generative AI (GenAI).
In December 2025, organisations globally continued to face sustained cyber pressure, with the average number of cyber-attacks per organisation per week reaching 2,027, a 1% increase from the previous month, and a 9% increase from December 2024.
Latin America key target for cyber criminals
Regionally, Latin America saw the sharpest increase in cyber attacks worldwide with organisations experiencing an average of 3,065 cyber attacks per week, representing a 26% year-over-year increase, the highest growth rate of any region.
Africa saw a year-on-year decline, indicating a shift in criminal focus rather than a reduction in threat levels.
Of the four African countries included in the report, Nigeria at 4 622 (+2% YoY) had the highest number of weekly attacks per organisation, followed by Angola at 4 002 (-10% YoY), Kenya at 2130 (-41% YoY) and South Africa 1850 (17% YoY).
The most attacked industries in Africa in December were Financial Services, Transportation & Logistics, and Government.
“The data highlights how attackers are expanding operations into fast-digitising regions where security maturity varies significantly,” says Hendrik de Bruin, Head Security Consulting, Check Point Software.
Ransomware attacks surge sharply
At the same time, ransomware attacks surged sharply, with 945 publicly reported ransomware incidents in December, marking a 60% increase compared to December 2024. Ransomware remains the most disruptive cyber threat globally, driving operational downtime, financial losses, and data extortion across industries. North America accounted for 52% of reported ransomware incidents, followed by Europe at 23%, reinforcing ransomware’s continued concentration in economically high-value regions
“December’s data shows that cyber risk is no longer about isolated spikes, but continuous pressure,” said Omer Dembinsky, Data Research Manager at Check Point Research.
“Ransomware continues to scale through industrialised operations, while unmanaged GenAI usage is creating widespread data exposure at enterprise level. Moving into 2026, organisations must prioritise prevention-first security, real-time AI threat intelligence, and strong governance over how AI tools are used across the business.”
Education, Government, and Nonprofits Face the Highest Cyber Attack Volumes
The Education sector remained the most targeted industry globally, with organisations experiencing an average of 4,349 cyber attacks per week in December, a 12% year-over-year increase.
“Large user populations, open digital environments, and aging infrastructure continue to make education organisations prime targets for cyber criminals,” de Bruin says.
The Government sector followed with 2,666 weekly cyber attacks per organisation, while Associations and Non-Profits recorded the second highest growth across all industries, with 2,509 attacks per week, representing a 56% year-over-year increase. Limited cyber security resources and growing digital dependency continue to elevate risk for these sectors.
Regional Cyber Attack Trends Show Growing Concentration
Beyond Latin America’s 26% year-on-year surge, APAC organisations averaged 3,017 cyber attacks per week, remaining among the most targeted regions globally. North America recorded 1,438 weekly attacks per organisation, with a 15% year-over-year increase, driven largely by ransomware activity. Europe averaged 1,677 attacks per week, up 9% year-over-year. As mentioned Africa saw a year-over-year decline.
Enterprise GenAI Usage Drives New and Scalable Data Exposure Risks
The rapid adoption of Generative AI tools in enterprise environments continues to introduce new cyber security and data protection challenges. In December 2025:
- 1 in every 27 GenAI prompts posed a high risk of sensitive data leakage
- 91% of organisations using GenAI tools experienced high-risk prompt activity
- 25% of prompts contained potentially sensitive or confidential information
- Organizations used an average of 11 different GenAI tools
- The average enterprise user generated 56 GenAI prompts per month
The primary risk out of these findings is that sensitive corporate data is being uploaded to third-party GenAI services without proper controls or sanitisation, often outside formal security governance. The most commonly exposed data includespersonally identifiable information (PII), internal network and IT artifacts, and proprietary source code.
With employees using an average of 11 different GenAI tools, organisations must be able to monitor and restrict what data is uploaded to each platform. These findings demonstrate how GenAI has become deeply embedded in daily business operations, but often without sufficient visibility, control, or security governance, thereby increasing exposure to data loss and AI-enabled cyber attacks.
Ransomware Operators Expand Activity as Qilin Leads December Campaigns
Among ransomware groups, Qilin emerged as the most active ransomware operator in December, responsible for 18% of publicly disclosed attacks. LockBit5 followed with 12%, while Akira accounted for 7%, continuing to target Windows, Linux, and virtualised ESXi environments. The expansion of Ransomware-as-a-Service (RaaS) models continues to lower the barrier to entry for attackers and accelerate global ransomware activity.
Cyber Security Outlook: Persistent Risks into 2026
December 2025 cyberattack data indicates that organisations are entering 2026 facing persistent ransomware pressure and systemic GenAI-driven data risk, rather than short-term fluctuations in attack volume.
“Strengthening ransomware resilience, deploying AI-powered prevention, and enforcing clear GenAI governance will be critical to reducing cyber risk in the year ahead,” de Bruin concludes.
For more insights into December 2025 cyberattack trends, visit the Check Point Research Blog.
Follow Check Point via:
LinkedIn: https://www.linkedin.com/company/check-point-software-technologies
Twitter: https://www.twitter.com/checkpointsw
Facebook: https://www.facebook.com/checkpointsoftware
Blog: https://blog.checkpoint.com
YouTube: https://www.youtube.com/user/CPGlobal
About Check Point Software Technologies Ltd.
Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading AI-powered, cloud-delivered cyber security platform provider protecting over 100,000 organisations worldwide. Check Point leverages the power of AI everywhere to enhance cyber security efficiency and accuracy through its Infinity Platform, with industry-leading catch rates enabling proactive threat anticipation and smarter, faster response times. The comprehensive platform includes cloud-delivered technologies consisting of Check Point Harmony to secure the workspace, Check Point CloudGuard to secure the cloud, Check Point Quantum to secure the network, and Check Point Infinity Platform Services for collaborative security operations and services.Legal Notice Regarding Forward-Looking StatementsÂ
This press release contains forward-looking statements. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this press release include, but are not limited to, statements related to our expectations regarding future growth, the expansion of Check Point’s industry leadership, the enhancement of shareholder value and the delivery of an industry-leading cyber security platform to customers worldwide. Our expectations and beliefs regarding these matters may not materialise, and actual results or events in the future are subject to risks and uncertainties that could cause actual results or events to differ materially from those projected. The forward-looking statements contained in this press release are also subject to other risks and uncertainties, including those more fully described in our filings with the Securities and Exchange Commission, including our Annual Report on Form 20-F filed with the Securities and Exchange Commission on April 2, 2024. The forward-looking statements in this press release are based on information available to Check Point as of the date hereof, and Check Point disclaims any obligation to update any forward-looking statements, except as required by law.Â