The North America cyber security statistics are out. Cyber risk in North America accelerated, concentrated, and repeated itself at scale in 2025. Data from the 2025 North America Threat Landscape Report shows a threat environment defined less by surprise and more by pressure. The same attack types, the same actors, and the same windows of opportunity appeared again and again, particularly in the United States, which accounted for roughly 93 percent of all recorded incidents in the Americas (note: this is all publicly recorded incidents, not attempted attacks). 

Three dynamics stand out, each shaping how organizations experienced risk over the past year and what they should expect next. 

The extortion economy is stable, competitive, and heavily optimized 

Ransomware in North America has reached a mature operating state. Ransomware accounted for approximately 45 percent of all recorded incidents, making it the dominant driver of operational and financial disruption across the region. The United States alone represented more than four out of five publicly reported ransomware incidents, with Canada forming a distant but consistent second tier. 

What is striking is the concentration. A relatively small group of ransomware operators generated the majority of observed activity. Qilin, Akira, and Clop together accounted for roughly 34 percent of all ransomware incidents, with Qilin leading at about 12.4 percent, followed closely by Akira at 11.5 percent and Clop at just over 10 percent.  

Additional groups such as Play, Incransom, Safepay, Rhysida, and Ransomhub maintained steady pressure, making for a crowded but highly competitive ecosystem. 

In most cases, these actors did not rely on novel techniques. Initial access often came through phishing, credential compromise, exposed services, and unpatched systems. What differentiated successful campaigns was execution speed and leverage. Encryption was frequently paired with data theft and public disclosure threats, extending the blast radius into legal, regulatory, and reputational domains. For North American organizations with complex environments and low tolerance for downtime, this model remained brutally effective throughout 2025. 

The web never stopped bleeding, even when nothing “critical” broke 

While ransomware drove the highest impact, the most persistent signal across North America was sheer volume of web compromise. Defacement activity represented roughly 35 percent of all incidents, making it the second most common attack type observed. These events were rarely sophisticated, often short lived, and frequently dismissed as low severity. Taken together, they formed a continuous layer of exposure that never meaningfully receded. 

The United States accounted for more than 72 percent of defacement incidents, reflecting the scale of publicly accessible infrastructure rather than sector specific weakness. A small number of actors dominated this space. ChinaFans alone was responsible for approximately one third of all defacement activity, followed by operators such as Mr. BDKR28, x7rootv, and Simsimi. Their campaigns favored automation, opportunistic scanning, and exposed CMS platforms over targeted intrusion. 

Their focus was trust. Government portals, educational institutions, and customer facing services were repeatedly altered in ways that were highly visible and reputationally damaging. Even as organizations invested in advanced detection and response, basic web exposure remained exploitable at scale across North America. 

Pressure peaks were predictable and attackers planned around them 

Cyber incidents across the Americas increased by more than 72 percent year over year, but North America showed a clear and repeatable seasonal pattern. December alone accounted for nearly 30 percent of all recorded incidents, far exceeding any other month. Smaller but notable peaks also appeared in February and March, while mid year activity remained comparatively lower. 

DDoS activity exemplified this pattern. Although DDoS represented just over 8 percent of total incidents, it experienced the steepest growth at 77 percent year over year. These attacks were frequently short, highly visible, and campaign driven, often aligning with geopolitical events or enforcement actions. Actors such as Dark Storm Team, NoName057(16), Mr Hamza, and Hezi Rash featured prominently, particularly in disruption focused waves targeting U.S. based services. 

At the same time, breach and data leak incidents grew by 31 percent, accounting for roughly 12 percent of overall activity.  

The United States represented nearly 70 percent of these cases, with actors like BreachLaboratory, UNC6395, and N1KA appearing most frequently among attributed incidents. Many of these breaches surfaced long after initial compromise, extending exposure and complicating response. 

Together, these trends show that 2025 risk was not random. Attackers repeatedly exploited known pressure windows when staffing was reduced, attention was fragmented, and digital dependency was highest. 

Looking ahead to 2026 

North America’s 2025 threat landscape was shaped by concentration, repetition, and scale. A small number of ransomware groups generated outsized impact. Opportunistic web compromise created constant background exposure. Campaign driven disruption surged during predictable periods. The full 2025 Americas Landscape Report – North America explores how these patterns are expected to persist into 2026, and what organizations can do now to reduce exposure before the next surge arrives.