By Polona Car with Öykü Dilara Anaç

In 2025, ransomware – malicious software that demands a ransom – remained a major cybersecurity threat in the EU, impacting individuals as well as the public and private sectors. Recent reports confirm that attack strategies have developed into complex, multilayered software systems that enable malicious actors to evade identification and carry out decentralised attacks. Additionally, artificial intelligence has emerged as a facilitator in both spreading and combating ransomware

By Isabella Voce and Anthony Morgan

This study examines the experiences of 331 Australian individuals and small to medium enterprise (SME) owners who were victims of ransomware. We used survey data to understand how they were targeted and the vulnerabilities that were exploited in private and work-related settings.

Most ransomware victims had received multiple ransom messages in the past 12 months. SME owners were more likely to have received multiple messages and to have previously paid a ransom. Strong messaging should dissuade SME owners from making these payments, which increase the chances of repeat victimisation.

SME owners reported impacts on many devices. The affected devices were also more likely to have been a work-issued device or a personal device used for work. SME owners were also more likely than other victims to report that the ransomware had spread to other workplace devices, systems or email accounts. The results highlight both the human element in victimisation and the need for technological solutions to protect business owners from ransomware and its harmful effect