To ask the Secretary of State for the Home Department, how many ransomware as a service operations were disrupted by the Regional Organised Crime Unit network in the 2025-26 financial year.

Ransomware is the most acute cyber threat facing most UK organisations, and the UK Government is committed to using the full scope of our capabilities to disrupt cyber threats and keep the public safe. The UK takes a multi-layered approach to tackling ransomware criminals including: working with international partners to build consensus and expose malicious cyber activity; investing in our domestic cyber capability and working with industry to improve resilience; developing the UK’s cyber sanctions regime; and exploring legislation to strengthen our defences.

Law enforcement outcomes are always a priority. Regional Organised Crime Units (ROCUs) and the National Crime Agency (NCA) work with international partners to investigate and, where possible, disrupt ransomware as a service (RaaS) operations. Disruptions take time and are complex. It would not be appropriate to comment on live and ongoing activity.

The NCA Annual Report^[1] for the year 2024-25 noted 12 high-impact disruptions relating to cyber crime, though this is not solely representative of disruptions targeted at RaaS operations. The figures for the accounting year 2025-26 have not yet been collated by the NCA. Recent successful disruptions activity includes the 2024 takedown of LockBit, and sanctions activity against and Media Land LLC (2025), ZSERVERS (2025), and Evil Corp (2024).

^[1] National Crime Agency Annual Report and Accounts - 2024-2025