Cryptowall had an estimated 625,000 infections and that's August 2014 numbers[1]. I believe it had many other campaigns since. Then you have Teslacrypt and Loc

Cryptowall had an estimated 625,000 infections and that's August 2014 numbers[1]. I believe it had many other campaigns since. Then you have Teslacrypt and Locky which I believe to be just as large if not larger. I don't think anyone has any good data on how big these attacks are. I suspect they actually number in the tens of millions. I think Brian Krebs had an article or two about these malware authors walking away with literally millions of dollars of bitcoin. That's a lot of infections. One of the problems is that most ransomware will run, encrypt the files, then delete themselves to avoid detection. That means AV doesn't get a chance to catch it later after updated definitions arrive. So AV reporting is useless and AV reporting is how we used to know how big infections were. I also think the AV industry is incentivized to not make a big fuss about ransomware because the infection numbers are embarrassing to them. So far they can't stop it with traditional means. A lot of shops run things like RansomFree, InterceptX, CarbonBlack, etc on top of now near useless traditional AV. https://www.scmagazine.com/cryptowall-surpasses-cryptolocker-in-infection-rates/article/539552/ https://www.scmagazine.com/cryptowall-surpasses-cryptolocker...