Ransomware in the News, 2019–2026: Attention, Geography and Tone of Global Ransomware Coverage, and How It Compares with Research and Invention

We measure how ransomware was covered in a global news index from January 2019 to July 2026, using 47,662 de-duplicated ransomware articles, and set that coverage beside 2,309 research papers and 466 patent families on ransomware. Six results stand out: A 2021 wave. Ransomware's share of news rose 3.05-fold from 2019 to 2021, from 1.89 to 5.77 articles per 10,000. By 2025 it had fallen to 2.44, 57.7% below the 2021 level. Event-driven peaks. The highest month was May 2021, the month of the Colonial Pipeline attack, at 12.52 articles per 10,000. The three highest months of the period all fall in May–July 2021. Geography. The United States holds 47.81% of located ransomware news, close to its weight in the index (lift 0.99). The United Kingdom (2.25), Russia (4.03) and Ukraine (3.3) are over-represented; Europe as a whole is at 1.67. Among US states, Nevada (2.64) stands out; several other high state lifts are place-tagging artefacts. Tone and urgency. 77.6% of ransomware articles are negative in tone (all news: 33.6%), and 90.9% are rated critical priority by the index's model (all news: 42.6%). Shifting attention. Between 2023 and 2025, ransomware's share of American news fell by about half (3.39 to 1.79 per 10,000), while it held steady in the United Kingdom and rose in Singapore. Research and invention. Ransomware papers grew from 0.27 to 0.67 per 10,000 papers from 2017 to 2025. Ransomware patent families grew 6.12-fold from 2017 to 2024, and the US office holds 52.3% of their office filings.