Europol’s IOCTA 2026 report, published on 28 April 2025, describes cybercrime not as isolated attacks but as a connected industrial economy. More than 120 active ransomware brands operated in 2025, with affiliate programmes offering margins of 80 to 85 per cent. Modern extortion has shifted from encryption to data leak threats, making backups necessary but insufficient. Industrial-scale SIM farms, such as the Latvian operation involving seven nationals, 1,200 devices, 40,000 SIM cards, and more than 49 million fraudulent accounts, now underpin the majority of online fraud. The report highlights enablers including residential proxies, bulletproof hosting, and crypto payment rails. Europol identifies a velocity gap: criminals move faster than law enforcement can respond. For UK small businesses, this matters because too much of the security industry still sells compliance theatre rather than defence against an industrial threat. This episode examines what the report actually says, what ransomware now looks like, why SMS authentication is dangerously weak, and three practical actions any small business can take this week.
