NCC Group plc has reported a notable decline in global ransomware attacks for May 2025, marking a 6% decrease to 393 cases. This reduction continues a trend observed over the past three months, despite high-profile cyber threats and geopolitical tensions. Safepay emerged as the most active threat actor, responsible for 18% of these attacks. The industrial sector remains the most targeted, accounting for 30% of all incidents. Additionally, there was a significant rise in attacks on the consumer discretionary sector, particularly retail, which saw an increase from 73 attacks in April to 102 in May. This surge is attributed to the targeting of major brands like Victoria's Secret, Adidas, Cartier, and Peter Green Chilled, driven by the high potential payouts and valuable customer data at stake. Matt Hull, Global Head of Threat Intelligence at NCC Group, emphasized the need for strengthened cyber security measures despite the decline in reported incidents. He pointed to the emergence of new threat actors like Safepay and the discovery of critical vulnerabilities in AI as indicators of the volatile ransomware landscape. Hull advocates for sustained investment in cyber defenses across industries, highlighting the integral role of cyber security in ensuring business resilience.