# Ransomware Activity

## **What this driver is**

Ransomware Activity is a continuing, time-varying factor within technology, the digital environment, and cybersecurity. It is modeled as a Driver because its intensity, capacity, or prevalence can change across reporting periods and can transmit the effects of multiple events, decisions, and institutions to later outcomes. It is not a dated event, a person, an organization, a welfare score, or an assertion that every movement in a correlated series was caused by the same mechanism. The relevant scope is the population, market, institution, infrastructure, or ecological system actually exposed to Ransomware Activity; a national or sectoral observation must not be silently generalized to the whole world.

The boundary of Ransomware Activity is narrower than its category and broader than one headline. It covers the durable condition named by the title, but excludes downstream welfare outcomes that must be measured separately. It also remains distinct from [Critical-Infrastructure Software Dependence](/drivers/critical-infrastructure-software-dependence): the two may interact or share a proxy, yet they represent different causal questions. Ransomware Activity is therefore a persistent analytical node, not a label for every adjacent development.

Ransomware Activity must be interpreted through its own named mechanism and evidence rather than inferred from the category label. The selected proxy identifies one observable facet; it does not collapse the Driver into [Secure Internet servers (per 1 million people](/indicators/digital-welfare-116-secure-internet-servers-per-1-million-people)) or erase distinctions from Critical-Infrastructure Software Dependence.

The temporal record attached to Ransomware Activity uses Secure Internet servers (per 1 million people) (IT.NET.SECR.P6) as a disclosed proxy for 2020-2024. The proxy is an observable lens, not a complete operational definition. A higher normalized value means more of Ransomware Activity, while a lower value means less; this measurement direction is not a welfare verdict. Current weight is derived from the latest real normalized observation rather than entered as an editorial score, probability, forecast, or confidence estimate.

## **Mechanism**

The mechanism for Ransomware Activity begins with a change in the factor itself and then moves through access to digital services, market power, operational security, information flows, and the distribution of technological capability. The first step is exposure: the change must reach identifiable households, firms, public bodies, infrastructure, ecosystems, or security actors. The second step is transmission through prices, incentives, rules, information, physical constraints, organizational capacity, or behavior. The third step is adaptation: exposed actors may substitute, relocate, delay decisions, change compliance, invest, seek protection, or pass costs to others. The final welfare effect is the net result after those responses, not the initial movement alone.

For Ransomware Activity, direct and indirect effects must be separated. A direct effect changes safety, access, income, health, legal protection, service continuity, or environmental exposure without a long chain of assumptions. An indirect effect passes through fiscal space, expectations, legitimacy, supply networks, knowledge, or capital formation. Each extra link makes timing and magnitude more conditional and raises the evidentiary burden for a graph relation.

Distribution is part of the mechanism. The same movement in Ransomware Activity may help one group and harm another because exposure, geography, wealth, age, legal status, occupation, insurance, and institutional quality differ. Analysis must identify who is exposed, who can adapt, and who bears transition costs; an aggregate average can conceal opposing effects.

Timing also matters for Ransomware Activity. Safety, availability, prices, or service interruption can move quickly; budgets, investment, reform, demography, diffusion, and capital replacement take longer. Feedback may reinforce the move, while substitution, policy response, learning, or resilience may offset it. The timeline records movement, but every DriverIndicatorImpact must separately state lag, direction, strength, and evidence.

## **Evidence base**

The primary quantitative record is the [Secure Internet servers (per 1 million people) dataset](https://api.worldbank.org/v2/country/all/indicator/IT.NET.SECR.P6?date=2020:2025&format=json&per_page=20000). It supplies the raw dated observations, provider unit, reporting scope, and aggregation note used for the 2020-2024 Driver series. Across that available record, Ransomware Activity finished above its first normalized observation: 0.81114756 in 2020 versus 0.84287515 in 2024. The minimum was 0.81114756 in 2020, the maximum was 0.84287515 in 2024, and the observed sequence contained 4 increases and 0 decreases. These are descriptive facts about the selected proxy; they are not an estimated causal effect on welfare.

Adjacent real observations create a segment only when the value changes; direction follows the sign and strength is the absolute change. The latest point sets current weight. Normalization preserves reproducibility but neither makes unlike concepts interchangeable nor turns a proxy into a complete index.

For Ransomware Activity, the provider describes the selected series in these terms: The number of distinct, publicly-trusted TLS/SSL certificates found in the Netcraft Secure Server Survey (by hosting country), per 1 million people. The cited producer is Secure Server Survey, Netcraft, uri: http://www.netcraft.com/;
World Bank population estimates, World Bank (WB). That qualification controls interpretation: coverage gaps, aggregation choices, revisions, reporting incentives, and the distance between the series and the Driver concept can all limit inference. Where the exact requested metric lacked sufficient observations and a documented fallback was used, the fallback remains visibly identified in the research artifact rather than presented as an exact measurement.

Separate context comes from [ITU ICT data and analytics](https://www.itu.int/itu-d/sites/statistics/). It supports domain vocabulary and setting, not hidden annual values or a manufactured coefficient. Evidence is strongest for observed proxy movement, weaker for the claim that Ransomware Activity caused an outcome, and weakest where the proxy captures a neighboring facet. Coincidence or association remains a hypothesis until analysis addresses confounding, reverse causality, selection, and measurement error.

## **Effect on welfare indicators**

The following indicators are the concrete welfare-sensitive endpoints against which Ransomware Activity should be evaluated. Their links resolve to existing Factrail Indicator records. They do not create a causal graph edge by themselves: an active DriverIndicatorImpact is warranted only when a source supports the specific pathway, direction, lag, and scope.

- [Internet penetration](/indicators/tech-internet-penetration-global). For Ransomware Activity, expected first-order direction is **lower**. The channel to test is network coverage, service prices, device access, reliability, skills, restrictions, and user trust. Horizon: months to several years. Confidence: medium for infrastructure and affordability channels. A same-period correlation would not prove this impact.
- [E-Government Development Index](/indicators/tech-egdi-global-average). For Ransomware Activity, expected first-order direction is **lower**. The channel to test is digital public infrastructure, institutional capacity, service design, interoperability, and inclusion. Horizon: one to several years. Confidence: low to medium. A same-period correlation would not prove this impact.
- [Global CO2 emissions per capita](/indicators/env-co2-emissions-per-capita-global). For Ransomware Activity, expected first-order direction is **higher**. The channel to test is compute demand, utilization, model and software efficiency, cooling, and the emissions intensity of electricity. Horizon: months to several years. Confidence: medium for compute-intensive deployment and low for other digital drivers. A same-period correlation would not prove this impact.

First-order effects for Ransomware Activity follow directly through named channels. Second-order effects depend on responses by governments, markets, organizations, communities, or households and may arrive later or with the opposite sign. Missing coefficients must not be replaced with round numbers; the relation stays draft or absent until evidence narrows the range.

## **Interactions and contested points**

Ransomware Activity can reinforce or offset other Drivers in technology, the digital environment, and cybersecurity, including Critical-Infrastructure Software Dependence, but shared timing is not enough to establish an interaction. Reinforcement is plausible when both factors act on the same bottleneck, exposed population, institutional rule, price, or infrastructure network. Offsetting is plausible when adaptation, substitution, redundancy, legal safeguards, fiscal support, or technological learning weakens the pathway. Conditional interaction is the default where one Driver changes the exposure or response to another rather than moving the welfare indicator independently.

The strongest skeptical interpretation is that the selected series is too remote from Ransomware Activity, that observed movement is driven by omitted factors, and that the broad causal narrative cannot identify a stable sign or magnitude across countries and periods. That objection is especially important when multiple Drivers share the same public dataset or when the series measures an outcome adjacent to the concept rather than the concept itself. The strongest competing interpretation is that a transparent proxy, clear boundaries, and explicit uncertainty are still more useful than an unmeasured label, provided the proxy is never mistaken for proof and the graph does not fabricate unsupported edges.

The record therefore separates what is established from what remains contested. Established here are the English canonical identity, the sourced 2020-2024 proxy observations, the disclosed normalization, and the distinction between Driver movement and welfare impact. Plausible but not automatically established are the indicator pathways listed above. Unresolved are universal causal magnitudes, responsibility, forecasts, and any claim outside the source scope. Publication or verification must not erase those boundaries; later evidence should update the relations and content through the governed pipeline rather than silently rewriting the history of Ransomware Activity.

## Dated facts

- 2026: HHS resolves four healthcare ransomware investigations. https://factrail.ai/facts/hhs-settles-four-healthcare-ransomware-investigations-2026.
- 2024: Change Healthcare ransomware attack disrupts U.S. health payments. https://factrail.ai/facts/change-healthcare-ransomware-attack-2024.
- 2024: International operation disrupts LockBit ransomware infrastructure. https://factrail.ai/facts/operation-cronos-disrupts-lockbit-2024.
- 2022: OFAC sanctions Blender.io virtual currency mixer. https://factrail.ai/facts/ofac-sanctions-blender-ransomware-linked-mixer-2022.
- 2022: Reported Conti ransomware attacks exceed one thousand. https://factrail.ai/facts/conti-ransomware-attacks-exceed-one-thousand-2022.
- 2021: REvil ransomware propagates through Kaseya VSA. https://factrail.ai/facts/revil-kaseya-supply-chain-ransomware-attack-2021.
- 2021: DarkSide ransomware disrupts Colonial Pipeline. https://factrail.ai/facts/colonial-pipeline-darkside-ransomware-attack-2021.
- 2020: U.S. agencies warn of increased ransomware targeting hospitals. https://factrail.ai/facts/us-healthcare-ransomware-threat-advisory-2020.
- 2018: SamSam campaign linked to hospitals and public institutions. https://factrail.ai/facts/samsam-ransomware-hospitals-municipalities-indictment-2018.
- 2017: NotPetya spreads from Ukraine into global networks. https://factrail.ai/facts/notpetya-destructive-malware-outbreak-2017.
- 2017: WannaCry ransomware spreads globally. https://factrail.ai/facts/wannacry-global-ransomware-outbreak-2017.
- 2013: FBI warns of CryptoLocker file-encrypting ransomware. https://factrail.ai/facts/fbi-warns-of-cryptolocker-ransomware-2013.

## Methodology

https://factrail.ai/methodology

Canonical: https://factrail.ai/drivers/ransomware-activity