Global Cyber Attacks Accelerate in December as Latin America Sees 26% Surge, Ransomware Jumps 60% Year-on-Year and GenAI Data Risks Expand

December 2025 cyberattack data highlights ransomware dominance, regional attack escalation, and growing enterprise GenAI exposure entering 2026

Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), has released its December 2025 Global Cyber Attack Statistics, revealing a cyber threat landscape increasingly defined by ransomware growth, regional concentration of cyber attacks, and rising data exposure linked to enterprise use of Generative AI (GenAI).

In December 2025, organisations globally continued to face sustained cyber pressure, with the average number of cyber-attacks per organisation per week reaching 2,027, a 1% increase from the previous month, and a 9% increase from December 2024.

Latin America key target for cyber criminals

Regionally, Latin America saw the sharpest increase in cyber attacks worldwide with organisations experiencing an average of 3,065 cyber attacks per week, representing a 26% year-over-year increase, the highest growth rate of any region.

Africa saw a year-on-year decline, indicating a shift in criminal focus rather than a reduction in threat levels.

 Of the four African countries included in the report, Nigeria at 4 622 (+2% YoY) had the highest number of weekly attacks per organisation, followed by Angola at 4 002 (-10% YoY), Kenya at 2130 (-41% YoY) and South Africa 1850 (17% YoY).

The most attacked industries in Africa in December were Financial Services, Transportation & Logistics, and Government.

"The data highlights how attackers are expanding operations into fast-digitising regions where security maturity varies significantly," says Hendrik de Bruin, Head Security Consulting, Check Point Software.

Ransomware attacks surge sharply

At the same time, ransomware attacks surged sharply, with 945 publicly reported ransomware incidents in December, marking a 60% increase compared to December 2024. Ransomware remains the most disruptive cyber threat globally, driving operational downtime, financial losses, and data extortion across industries. North America accounted for 52% of reported ransomware incidents, followed by Europe at 23%, reinforcing ransomware's continued concentration in economically high-value regions 

"December's data shows that cyber risk is no longer about isolated spikes, but continuous pressure," said Omer Dembinsky, Data Research Manager at Check Point Research.

"Ransomware continues to scale through industrialised operations, while unmanaged GenAI usage is creating widespread data exposure at enterprise level. Moving into 2026, organisations must prioritise prevention-first security, real-time AI threat intelligence, and strong governance over how AI tools are used across the business."

Education, Government, and Nonprofits Face the Highest Cyber Attack Volumes

The Education sector remained the most targeted industry globally, with organisations experiencing an average of 4,349 cyber attacks per week in December, a 12% year-over-year increase.

"Large user populations, open digital environments, and aging infrastructure continue to make education organisations prime targets for cyber criminals," de Bruin says.

The Government sector followed with 2,666 weekly cyber attacks per organisation, while Associations and Non-Profits recorded the second highest growth across all industries, with 2,509 attacks per week, representing a 56% year-over-year increase. Limited cyber security resources and growing digital dependency continue to elevate risk for these sectors. 

Regional Cyber Attack Trends Show Growing Concentration

Beyond Latin America's 26% year-on-year surge, APAC organisations averaged 3,017 cyber attacks per week, remaining among the most targeted regions globally. North America recorded 1,438 weekly attacks per organisation, with a 15% year-over-year increase, driven largely by ransomware activity. Europe averaged 1,677 attacks per week, up 9% year-over-year. As mentioned Africa saw a year-over-year decline.

Enterprise GenAI Usage Drives New and Scalable Data Exposure Risks

The rapid adoption of Generative AI tools in enterprise environments continues to introduce new cyber security and data protection challenges. In December 2025:

    1 in every 27 GenAI prompts posed a high risk of sensitive data leakage
    91% of organisations using GenAI tools experienced high-risk prompt activity
    25% of prompts contained potentially sensitive or confidential information
    Organizations used an average of 11 different GenAI tools
    The average enterprise user generated 56 GenAI prompts per month

The primary risk out of these findings is that sensitive corporate data is being uploaded to third-party GenAI services without proper controls or sanitisation, often outside formal security governance. The most commonly exposed data includes personally identifiable information (PII), internal network and IT artifacts, and proprietary source code.

With employees using an average of 11 different GenAI tools, organisations must be able to monitor and restrict what data is uploaded to each platform. These findings demonstrate how GenAI has become deeply embedded in daily business operations, but often without sufficient visibility, control, or security governance, thereby increasing exposure to data loss and AI-enabled cyber attacks.

Ransomware Operators Expand Activity as Qilin Leads December Campaigns

Among ransomware groups, Qilin emerged as the most active ransomware operator in December, responsible for 18% of publicly disclosed attacks. LockBit5 followed with 12%, while Akira accounted for 7%, continuing to target Windows, Linux, and virtualised ESXi environments. The expansion of Ransomware-as-a-Service (RaaS) models continues to lower the barrier to entry for attackers and accelerate global ransomware activity. 

Cyber Security Outlook: Persistent Risks into 2026

December 2025 cyberattack data indicates that organisations are entering 2026 facing persistent ransomware pressure and systemic GenAI-driven data risk, rather than short-term fluctuations in attack volume.

"Strengthening ransomware resilience, deploying AI-powered prevention, and enforcing clear GenAI governance will be critical to reducing cyber risk in the year ahead," de Bruin concludes.

For more insights into December 2025 cyberattack trends, visit the Check Point Research Blog.

 

Follow Check Point via:

LinkedIn: https://www.linkedin.com/company/check-point-software-technologies

Twitter: https://www.twitter.com/checkpointsw

Facebook: https://www.facebook.com/checkpointsoftware

Blog: https://blog.checkpoint.com 

YouTube: https://www.youtube.com/user/CPGlobal

 

About Check Point Software Technologies Ltd.  

Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading AI-powered, cloud-delivered cyber security platform provider protecting over 100,000 organisations worldwide. Check Point leverages the power of AI everywhere to enhance cyber security efficiency and accuracy through its Infinity Platform, with industry-leading catch rates enabling proactive threat anticipation and smarter, faster response times. The comprehensive platform includes cloud-delivered technologies consisting of Check Point Harmony to secure the workspace, Check Point CloudGuard to secure the cloud, Check Point Quantum to secure the network, and Check Point Infinity Platform Services for collaborative security operations and services.
Legal Notice Regarding Forward-Looking Statements 
This press release contains forward-looking statements. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this press release include, but are not limited to, statements related to our expectations regarding future growth, the expansion of Check Point's industry leadership, the enhancement of shareholder value and the delivery of an industry-leading cyber security platform to customers worldwide. Our expectations and beliefs regarding these matters may not materialise, and actual results or events in the future are subject to risks and uncertainties that could cause actual results or events to differ materially from those projected. The forward-looking statements contained in this press release are also subject to other risks and uncertainties, including those more fully described in our filings with the Securities and Exchange Commission, including our Annual Report on Form 20-F filed with the Securities and Exchange Commission on April 2, 2024. The forward-looking statements in this press release are based on information available to Check Point as of the date hereof, and Check Point disclaims any obligation to update any forward-looking statements, except as required by law.