TL;DR

A wave of cyberattacks in 2025 produced direct human harm beyond financial loss, including a confirmed ransomware-linked death, weaponised children's data, and a rise in violent crypto thefts. Law enforcement and security firms reported growing use of physical threats, AI-enabled 'virtual kidnappings', and attacks that disrupted public emergency-alert services.

What happened

Throughout 2025, incidents tied to cybercriminal activity produced tangible human costs in several distinct ways. Health services were affected when a delay in pathology services linked to a 2024 ransomware incident was officially connected to a patient fatality this year, marking what is reported as the first confirmed ransomware-related death. Criminal groups also targeted civilians' personal data: images and contact details for pre-school children were posted online in a brazen leak that drew condemnation even from other threat actors. High-profile commercial disruption struck Jaguar Land Rover, whose multi-week production shutdown cost more than £2 billion and prompted government financial intervention while suppliers and employees felt acute economic pressure. Violent offences associated with crypto thefts and extortion rose, including kidnappings and amputations; researchers and policing bodies flagged an increase in so-called "violence as a service". Separately, emergency-alert infrastructure and related services were compromised, exposing citizen data and temporarily preventing use of alert platforms.

Why it matters

  • Cybercrime risks are extending beyond data and financial loss to physical harm and threats to life.
  • Disruption to healthcare, emergency alerts and major manufacturers can cascade into public-health and economic crises.
  • Criminals are combining digital tools — including AI-generated media — with real-world violence, complicating prevention and response.
  • Ransom and extortion negotiations increasingly include explicit threats against families, raising new safety and legal challenges.

Key facts

  • A patient death tied to service disruption from the Synnovis/Qilin incident was officially confirmed in 2025; the underlying attack occurred in 2024.
  • A group named Radiant posted images and personal details of 10 pre-school children after compromising Kido International, sparking rare public condemnation from other cybercriminals.
  • Jaguar Land Rover experienced a roughly five-week outage, with estimated costs above £2 billion and a government-backed financial support package; suppliers reported layoffs and workers feared economic hardship.
  • Security firms reported a noticeable rise in violent crimes linked to cryptocurrency thefts; one tracker recorded 67 violent crypto thefts in 2025.
  • A reported increase in "violence as a service" activity was highlighted by cybersecurity vendors, who also documented more extortion discussions that included physical threats.
  • A Semperis study found about 40% of ransomware victims had been threatened with physical harm during negotiations.
  • Europol's Operation GRIMM led to the arrest of 193 suspects tied to contract killings, intimidation and torture, with minors allegedly groomed or coerced to carry out crimes.
  • The FBI warned of AI-enabled "virtual kidnappings", where doctored images are used to extort families; hundreds of emergency scams reported last year cost victims roughly $2.7 million.
  • An attack on Crisis24 affected access to the CodeRED emergency alert app and resulted in stolen citizen data; some authorities reverted to social media to issue alerts while the service was restored.
  • A separate outage affecting UK telecoms firm services in July was attributed to a software fault that prevented some emergency calls, not a cyberattack.

What to watch next

  • Whether threats of physical violence in ransomware negotiations continue to climb and how incident responders adapt.
  • The scale and sophistication of AI-driven 'virtual kidnappings' and law enforcement's ability to identify deepfakes quickly.
  • not confirmed in the source
  • not confirmed in the source

Quick glossary

  • Ransomware: Malicious software that encrypts files or systems and demands payment for restoration or to avoid data exposure.
  • Deepfake: Synthetic media created or altered by AI to convincingly depict people saying or doing things they did not actually do.
  • Violence as a service: A criminal model where perpetrators or intermediaries offer to carry out or arrange physical harm for payment.
  • Emergency alert system: A platform used by authorities to send rapid public warnings about imminent threats like severe weather, public safety incidents or other emergencies.

Reader FAQ

Was the Synnovis incident the first time a cyberattack was linked to a death?
The Synnovis-Qilin case is reported as the first confirmed instance where a ransomware-related disruption was officially connected to a patient fatality; other studies have previously suggested possible deaths but lacked confirmed links.

Did law enforcement make arrests related to violent cyber-enabled crimes in 2025?
Europol reported arrests—193 suspects—connected to crimes including contract killings, intimidation and torture as part of an operational taskforce.

Are emergency-alert systems routinely taken offline by cyberattacks?
Not confirmed in the source; two incidents were noted: a CodeRED provider was attacked and access to alerts was temporarily lost, while a separate telecom outage that disrupted emergency calls was attributed to a software fault, not a cyberattack.

Have children been targeted with leaked personal data this year?
Yes. A breach affecting Kido International resulted in images and home-contact details for 10 preschool children being posted online.

CYBER-CRIME Death, torture, and amputation: How cybercrime shook the world in 2025 The human harms of cyberattacks piled up this year, and violence expected to increase Connor Jones Sun 28 Dec 2025 //…

Sources

Related posts

By

Leave a Reply

Your email address will not be published. Required fields are marked *