Quick answer: the most famous ransomware families include WannaCry, NotPetya, LockBit, Conti and REvil. In 2025 the United States was by far the most targeted country, with around half of all known attacks worldwide. Portugal is a target too: companies such as EDP and TAP have been hit, and incidents recorded by the national cybersecurity centre (CNCS) keep rising.
Ransomware is malicious software that locks or encrypts a company's files and demands a payment (the "ransom") to restore them. Today most groups also steal the data before encrypting it and threaten to publish it if the victim does not pay. These are the cases that changed how the world thinks about cybersecurity.
The 10 most famous ransomware attacks
1. CryptoLocker (2013)
Spread through email attachments and was one of the first to demand payment in bitcoin, the model every group has followed since. It was taken down in 2014 by an international police operation.
2. WannaCry (2017)
In May 2017 it infected hundreds of thousands of computers in around 150 countries within days, including hospitals in the UK's National Health Service. It exploited a Windows flaw that Microsoft had patched two months earlier. The lesson: companies with up-to-date computers were not affected.
3. NotPetya (2017)
It entered through a tampered update of accounting software used in Ukraine and spread worldwide. It looked like ransomware but destroyed data with no way of recovery. Damage was estimated at around 10 billion dollars, and companies such as shipping giant Maersk had to reinstall thousands of computers. The US and UK governments attributed the attack to the Russian military.
4. Ryuk (2018–2021)
Known for attacking hospitals and large organisations, choosing victims able to pay high ransoms. It marked the shift from mass attacks to targeted ones.
5. Ragnar Locker (2020–2023): the Portuguese case
The best-known ransomware in Portugal. In 2020 it hit energy company EDP: the group claimed to have stolen 10 TB of data and demanded 1,580 bitcoins, about 10 million euros at the time. In 2022 it attacked airline TAP and published data it claimed belonged to around 1.5 million customers. The group was dismantled in 2023 in an international operation coordinated by Eurojust.
6. DarkSide (2021)
Attacked Colonial Pipeline, the largest fuel pipeline in the US, which was shut down for several days and caused fuel shortages in several states. The company paid around 4.4 million dollars, part of which was later recovered by the FBI.
7. REvil (2021)
Exploited a flaw in Kaseya, remote management software used by IT support companies, to reach around 1,500 client businesses at once. It demanded 70 million dollars. The lesson: the tools used by whoever manages your IT must also be protected and kept up to date.
8. Conti (2022)
Attacked several Costa Rican government ministries, leading the government to declare a national emergency, something unprecedented for a cyberattack.
9. LockBit (2019–2024)
For years the most active group in the world, operating as "ransomware as a service": it rented its software to other criminals in exchange for a share of the ransoms. In February 2024, the international Operation Cronos took control of its infrastructure.
10. Clop (2023–present)
Rather than encrypting computers, it specialised in exploiting flaws in file transfer software. In 2023 a flaw in MOVEit let it steal data from thousands of organisations. It remains among the most active groups: third by number of attacks in 2025.
Which countries are most targeted by ransomware?
Around 7,400 ransomware attacks were recorded worldwide in 2025, 32% more than in 2024. The United States accounted for about half:
| Country | Attacks in 2025 |
|---|---|
| United States | 3,810 (51% of total) |
| Canada | 392 |
| Germany | 303 |
| United Kingdom | 251 |
| France | 178 |
The US leads because it has more and larger companies with a greater ability to pay. These figures are mainly based on what the groups themselves publish on their leak sites, and only some are confirmed by victims, so the real number of attacks is probably higher.
The most active groups in 2025 were Qilin (over 1,000 attacks), Akira and Clop. Names change quickly because when police dismantle a group, its members often return under a new name.
What about Portugal?
According to Portugal's National Cybersecurity Centre (CNCS), 2,758 incidents were recorded in 2024 (excluding automatically detected ones), 36% more than the year before. Ransomware is less frequent than in previous years, but the attacks that do happen have a major impact, especially in healthcare, education and public administration.
Small and medium-sized businesses rarely make the news, but they are frequent targets: they have less protection and often no backup outside the network.
Does war affect your company's IT security?
Yes, even if your company has nothing to do with the conflict. NotPetya is the best example: it emerged in a context of war and ended up paralysing companies worldwide that were simply customers or suppliers of Ukrainian businesses.
In 2024 the CNCS recorded campaigns by pro-Russian groups against Portugal, mainly attacks that take websites offline (DDoS) and website defacements. For 2025 it warns of more cyber espionage linked to conflicts and of politically motivated groups using the same tools as criminals, including ransomware. In practice, the higher the international tension, the more the basics matter. We cover this in detail in a dedicated article.
How to protect your business against ransomware
- Backups with one copy off the network. Follow the 3-2-1 rule: three copies, on two different media, one of them off-site or disconnected. And test recovery regularly.
- Keep everything updated: Windows, applications, routers and firewalls. WannaCry only hit unpatched systems.
- Two-factor authentication on email, remote access and administrator accounts.
- Staff training to recognise fake emails (phishing), the most common way in.
- Professional antivirus with monitoring, not just the free version.
- Give each user only the access they need. Non-administrators should not install software.
- A separate network for guests, cameras and devices, so one infection does not reach everything.
- A plan for the day of the attack: who to call, how to disconnect affected devices and where the backups are.