Check Point Research has released its Global Threat Intelligence Report for September 2025, showing that organisations worldwide each faced an average of 1,900 cyberattacks per week. While this marked a 4 per cent decrease from August, it represented a 1 per cent increase year-over-year, confirming that global cyber threats remain at historically elevated levels despite periodic fluctuations.

With the rising use of generative AI (GenAI) across all sectors, the report identified emerging risk from GenAI adoption: 1 in every 54 GenAI prompts from enterprise environments posed a high risk of sensitive data leakage, impacting 91 per cent of organisations that use GenAI tools regularly. An additional 15 per cent of prompts contained potentially sensitive information, such as customer details, proprietary code, or internal communications, underscoring the growing need for AI governance and data protection measures.

Looking at impact on the sectors – the education sector once again was the most targeted globally, experiencing an average of 4,175 weekly attacks per organisation in September (–3 per cent YoY). This consistent targeting reflects both the sector’s rapid digital transformation — which expands its attack surface — and its typically underfunded cyber security defenses, which make it a frequent and easy target for cybercriminals.

The telecommunications industry, vital to business continuity and consumer connectivity, suffered 2,703 weekly attacks per organisation (+6 per cent YoY), highlighting its dual role as critical infrastructure and an access point to downstream targets. Government institutions, a long-standing focus for both criminal and nation-state actors, recorded 2,512 weekly attacks (–6 per cent YoY).

Regionally, Africa reported the highest average number of weekly cyberattacks per organisation, with 2,902 (–10 per cent YoY), followed by Latin America (2,826, +7 per cent YoY) and APAC (2,668, –10 per cent YoY). Europe registered 1,577 weekly attacks (–1 per cent YoY), while North America stood out with a 17 per cent year-over-year surge to 1,468 weekly attacks, driven in part by a sharp increase in ransomware incidents.

Ransomware remained one of the most disruptive and financially damaging cyber threats, with 562 publicly reported incidents globally in September, up 46 per cent year-over-year. North America was the most affected region, accounting for 54 per cent of reported cases, followed by Europe (19 per cent). The United States alone represented 52 per cent of all published ransomware cases, followed by Korea (5 per cent) and the United Kingdom (4 per cent).

By industry, the construction and engineering sector was the most impacted sector by ransomware, representing 11.4 per cent of reported victims, closely followed by business services (11 per cent) and industrial manufacturing (10.1 per cent). other sectors, including financial services, healthcare, and consumer goods, were also significantly affected, illustrating ransomware’s broadening scope.

Leading ransomware groups included Qilin (14.1 per cent of attacks), Play (9.3 per cent), and Akira (7.3 per cent). Qilin, one of the most established RaaS (Ransomware-as-a-Service) groups, continues to expand aggressively, while Play and Akira are increasingly targeting critical sectors like manufacturing and business services using Rust-based encryptors and advanced runtime controls.

Commenting on the report, Omer Dembinsky, data research manager, Check Point Research, said, “September’s threat data shows that while the overall volume of attacks has eased slightly, the impact and sophistication of cyber threats are intensifying. Ransomware remains the most destructive force, while the emergence of GenAI-related data leakage adds a new dimension of risk for organisations. Cybercriminals will likely seek to exploit every innovation faster than users can adapt. The only sustainable defense is a prevention-first strategy powered by real-time AI, ensuring protection across the network, cloud, endpoints, and identities. Only through this approach can organisations stay ahead and protect critical operations from relentless adversaries.”