Ransomware is malicious software that locks an organization’s files or steals its data, then demands payment. It hits hospitals, schools, factories and small firms. This page covers how often attacks happen, how much victims pay, what recovery costs and how attackers get in. Here are the latest ransomware statistics.
Top Ransomware Statistics
- 48% of breaches analyzed in Verizon’s 2026 DBIR involved ransomware, up from 44% the year before (Verizon, 2026 Data Breach Investigations Report).
- 3,611 ransomware complaints reached the FBI’s IC3 in 2025 (FBI IC3, 2025 IC3 Annual Report).
- 2,139 ransomware victims were posted on leak sites in Q2 2026, up 33% from Q2 2025 (Check Point Research, The State of Ransomware Q2 2026).
- More than $820 million in on-chain payments was received by ransomware actors in 2025 (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report).
- $769,000 was the median ransom payment in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
- 19% of Coveware clients hit by cyber extortion paid a ransom in Q2 2026, a record low (Coveware, Adverse cyber extortions are more common than commonly advised).
- $1,700,200 was the mean cost to recover from a ransomware attack, excluding ransom, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
- 26% of ransomware attacks started with a malicious email and 24% with phishing, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
How Common Are Ransomware Attacks?
Verizon’s yearly Data Breach Investigations Report (DBIR) shows how often ransomware turns up in data breaches.
In Verizon’s DBIR, a “breach” is an incident with confirmed disclosure of data to an unauthorized party, not just potential exposure (Verizon, 2026 Data Breach Investigations Report).
1. 48% of breaches analyzed in Verizon’s 2026 DBIR involved ransomware, up from 44% the year before (Verizon, 2026 Data Breach Investigations Report).
48% of confirmed data breaches in Verizon’s 2026 DBIR involved ransomware
Source: Verizon, 2026 Data Breach Investigations Report, confirmed breaches analyzed in the 2026 report.
Other Estimates of Ransomware Activity
Other sources measure ransomware activity in their own ways. They look at breached companies, incident response cases, security data, insurance clients and bank reports.
IBM defines a “data breach” as an event putting records with personal, financial, medical or confidential data at risk. Its study covers organizations breached between March 2025 and February 2026 (IBM, Cost of a Data Breach Report 2026).
2. 39% of breached organizations said their systems were hit by ransomware in IBM’s 2026 study (IBM, Cost of a Data Breach Report 2026).
Mandiant counts a “ransomware-related intrusion” as one that provides access for, or is associated with, a group whose primary goal is encrypting data to extract payment (Mandiant, M-Trends 2026).
3. 13% of Mandiant’s 2025 incident investigations were ransomware-related intrusions (Mandiant, M-Trends 2026).
4. 7% growth in ransomware attacks reaching encryption was seen by Microsoft in 2024–2025, down from 102% in 2023–2024 (Microsoft, Digital Defense Report 2025).
5. 15.8% more ransomware payloads were run against enterprises from July 2025 to June 2026 than a year earlier, Microsoft Defender data shows (Microsoft, 2026 Digital Defense Report).
6. 33% fewer cyber extortion events were reported by Marsh clients in the US and Canada in 2025 than in 2024 (Marsh, US & Canada cyber claims 2025). The 2025 data was gathered through November and extrapolated for the full year.
7. 1,476 ransomware incidents were reported to FinCEN for 2024, down 2% from 1,512 in 2023 (FinCEN, Financial Trend Analysis: Ransomware). There were 1,206 reported incidents in 2022.
What Does FBI Data Show About Ransomware?
These figures come from complaints filed with the FBI’s Internet Crime Complaint Center (IC3).
In the FBI IC3 report, “ransomware complaints” are complaints filed with IC3 under the ransomware crime type; each complaint has only one crime type, and some complainants may have filed more than once (FBI IC3, 2025 IC3 Annual Report).
8. 3,611 ransomware complaints reached the FBI’s IC3 in 2025 (FBI IC3, 2025 IC3 Annual Report).
9. 3,156 ransomware complaints were filed with IC3 in 2024, and 2,825 in 2023 (FBI IC3, 2025 IC3 Annual Report).
In the FBI IC3 report, “ransomware adjusted losses” usually exclude lost business, time, wages, files, equipment and third-party remediation services, and cover only what entities report to the FBI via IC3 (FBI IC3, 2025 IC3 Annual Report).
10. $32,320,105 in ransomware losses was reported to IC3 in 2025 (FBI IC3, 2025 IC3 Annual Report).
11. 63 new ransomware variants were identified via IC3 in 2025 (FBI IC3, 2025 IC3 Annual Report). That averages 5.25 new variants per month.
12. 56.8% of ransomware incidents reported to IC3 in 2025 involved the 10 most-reported variants, led by Akira (FBI IC3, 2025 IC3 Annual Report).
What Do Ransomware Leak Sites Show?
Ransomware groups post the names of victims on data leak sites. Security firms and insurers track these sites and count the posts.
In Check Point’s reports, a “victim” is one that a double-extortion ransomware group published on a data leak site Check Point monitors; an “active group” posted at least one victim in the quarter (Check Point Research, The State of Ransomware Report Q2 2026 (PDF)).
13. 2,139 ransomware victims were posted on leak sites in Q2 2026, up 33% from Q2 2025 (Check Point Research, The State of Ransomware Q2 2026).
14. 2,416 ransomware victims were posted on leak sites in Q4 2025, an all-time quarterly record in Check Point’s data (Check Point Research, The State of Ransomware Q1 2026).
15. 93 ransomware groups posted victims on leak sites in Q2 2026, a new high in Check Point’s tracking (Check Point Research, The State of Ransomware Q2 2026). The top 10 groups accounted for 57.6% of victims.
16. 42% of leak-site ransomware victims in Q2 2026 were in the US, down from 50% in Q1 (Check Point Research, The State of Ransomware Q2 2026).
In Corvus by Travelers’ reports, “victims posted to leak sites” are organizations typically named after refusing to pay, so the count is only a fraction of all ransomware activity (Corvus by Travelers, Q4 ’25 Travelers Cyber Threat Report).
17. 50% more ransomware victims were posted on leak sites in 2025 than in 2024, per Corvus by Travelers (Corvus by Travelers, Q4 ’25 Travelers Cyber Threat Report).
How Much Money Do Ransomware Attackers Make?
These figures track the money victims pay to ransomware groups. Chainalysis follows crypto payments on the blockchain, and FinCEN counts payments that financial institutions report.
In Chainalysis’ report, “ransomware payments” are on-chain payments received by ransomware actors, meaning crypto payments traceable on the blockchain; totals can rise later as Chainalysis attributes more events and payments (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report).
18. More than $820 million in on-chain payments was received by ransomware actors in 2025 (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report). Chainalysis says this was an 8% decline from its updated 2024 estimate.
Annual on-chain ransomware payments from 2020 to 2025, as estimated by Chainalysis in 2026
Source: Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report, estimates as of the 2026 report.
19. $892 million was Chainalysis’s updated estimate of 2024 on-chain ransomware payments (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report). The 2024 figure was revised in the 2026 report.
20. $813 million was Chainalysis’s first estimate of 2024 ransomware payments, before later revision (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report). Chainalysis says its 2025 total is likely to approach or exceed $900 million as more payments are attributed.
In FinCEN’s analysis, “ransomware payments” are amounts in Bank Secrecy Act (BSA) reports filed by regulated financial institutions, and include both actual and attempted transactions. The data does not cover all ransomware attacks or payments (FinCEN, Financial Trend Analysis: Ransomware).
21. About $1.1 billion in ransomware payments was reported in FinCEN’s BSA data for 2023 incidents, an all-time high for that data (FinCEN, Financial Trend Analysis: Ransomware). The figure covers 1,512 reported incidents.
22. About $734 million in ransomware payments was reported in FinCEN’s BSA data for 2024 incidents, across 1,476 incidents (FinCEN, Financial Trend Analysis: Ransomware). FinCEN says 2024 was still the third-highest year since reports began in 2013.
How Much Do Ransomware Attackers Demand and Get Paid?
These figures show how much attackers demand and how much victims pay.
In Sophos’ State of Ransomware survey, all respondents’ organizations had been hit by ransomware in the previous 12 months (Sophos, The State of Ransomware 2026).
In Sophos’s report, the “median ransom payment” counts only organizations that paid, while the “percent that paid” is among organizations whose data was encrypted. Demand figures exclude demands of $40 million or more (Sophos, The State of Ransomware 2026).
23. $769,000 was the median ransom payment in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). It is based on 530 organizations that paid and shared the amount. Last year’s report put the median at $1 million.
24. 48% of ransom payments in Sophos’ 2026 survey were $1 million or more, down from 52% a year earlier (Sophos, The State of Ransomware 2026).
25. $698,000 was the median ransom demand among organizations with encrypted data in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). Sophos says median demands fell 65% over two years.
26. $3,126,372 was the mean ransom demand in Sophos’ 2026 survey, 28% lower than in its 2024 report (Sophos, The State of Ransomware 2026).
27. $5.7 million was the median ransom demand for organizations with over $5 billion in revenue in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). Organizations under $50 million in revenue faced a median demand of about $140,000.
28. 51% of ransom payers paid less than the attackers first demanded in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). Another 30% paid the full demand and 18% paid more.
29. $1,880,612 was the average ransom payment in Coveware cases in Q2 2026 (Coveware, Adverse cyber extortions are more common than commonly advised). That was up 176% from Q1 2026.
30. $150,000 was the median ransom payment in Coveware cases in Q2 2026 (Coveware, Adverse cyber extortions are more common than commonly advised). That was down 50% from Q1 2026.
31. $59,556 was the median on-chain ransomware payment in 2025, up from $12,738 in 2024 (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report). Chainalysis says the median payment rose 368% year over year.
32. $155,257 was the median single ransomware transaction in FinCEN’s BSA data for 2024 incidents (FinCEN, Financial Trend Analysis: Ransomware). The median was $175,000 in 2023 and $124,097 in 2022.
How Many Ransomware Victims Pay the Ransom?
These figures show how often victims pay. Each source counts a different group of victims.
In Coveware’s reports, the “payment rate” is the share of its own incident-response clients that end up paying the ransom (Coveware, Adverse cyber extortions are more common than commonly advised).
33. 19% of Coveware clients hit by cyber extortion paid a ransom in Q2 2026, a record low (Coveware, Adverse cyber extortions are more common than commonly advised). The rate covers cases Coveware worked on.
Share of Coveware ransomware cases where the ransom was paid, Q1 2019 to Q2 2026
Source: Coveware, Adverse cyber extortions are more common than commonly advised, share of Coveware cases where the ransom was paid, by quarter.
34. 23% of Coveware-managed cases ended in a ransom payment in Q1 2026 (Coveware, Patch management goes from hard, to ludicrous in the agentic AI era).
In Coveware’s reports, “DXF-only” cases are extortions where attackers stole data but did not encrypt systems (Coveware, Adverse cyber extortions are more common than commonly advised).
35. 15% of data-theft-only extortion cases handled by Coveware ended in payment in Q2 2026, a historically low level (Coveware, Adverse cyber extortions are more common than commonly advised). In these cases, attackers stole data but did not encrypt systems.
36. 48% of organizations whose data was encrypted paid the ransom in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). Sophos puts the four-year average at 50%.
37. 28% is Chainalysis’s estimate of the share of ransoms paid in 2025, potentially an all-time low (Chainalysis, Crypto Ransomware: 2026 Crypto Crime Report).
38. About 9% of publicized victims paid the ransom for the median ransomware group, per Verizon’s 2026 DBIR (Verizon, 2026 Data Breach Investigations Report). Verizon matched victims named by attackers with known crypto-wallet payments.
39. 86% of businesses in Coalition’s 2025 claims data refused to pay ransom demands, a record (Coalition, 2026 Cyber Claims Report announcement).
How Much Does a Ransomware Attack Cost?
These figures cover what it costs to recover from an attack, apart from any ransom, and what insurers pay out.
Sophos measures recovery cost by asking what it cost to rectify the impacts of the most significant ransomware attack, excluding any ransom paid; this includes downtime, people time, device cost, network cost and lost opportunity (Sophos, The State of Ransomware 2026).
40. $1,700,200 was the mean cost to recover from a ransomware attack, excluding ransom, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
41. $375,000 was the median ransomware recovery cost in Sophos’ 2026 survey, unchanged from last year’s report (Sophos, The State of Ransomware 2026).
42. $2.51 million was the mean cost for U.S. organizations to recover from ransomware, excluding ransom, in Sophos’ 2026 survey (Sophos, The State of Ransomware in the U.S. 2026).
Coalition’s “claims” data comes from its own policyholders in the US, Canada, the UK, Australia and Germany (Coalition, 2026 Cyber Claims Report announcement).
43. $269,000 was the average loss on a ransomware insurance claim in 2025, the costliest claim type (Coalition, 2026 Cyber Claims Report announcement).
Allianz Commercial’s “large claims” are cyber insurance claims worth more than €1 million. Its dataset covers 2021 to the first half of 2025 (Allianz Commercial, Cyber security resilience 2025).
44. Around 60% of the value of large cyber insurance claims Allianz analyzed in the first half of 2025 came from ransomware (Allianz Commercial, Cyber security resilience 2025). Large claims are those over €1 million.
How Do Organizations Recover From Ransomware?
These figures show how fast organizations recover and how often backups help.
45. 55% of organizations fully recovered from a ransomware attack within one week, according to Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
46. 66% of organizations whose data was encrypted used backups to recover it in Sophos’ 2026 survey, up from 54% in the 2025 report (Sophos, The State of Ransomware 2026).
Veeam’s “Data Trust and Resilience Report 2026” surveys senior IT, security and risk leaders worldwide (Veeam, Data Trust and Resilience Report 2026 press release).
47. 28% of ransomware victims whose operations or data were affected fully recovered all affected data, according to Veeam’s 2026 report (Veeam, Data Trust and Resilience Report 2026 press release).
48. 72% of affected data was recovered on average after a ransomware attack, per Veeam’s 2026 report (Veeam, Data Trust and Resilience Report 2026 press release).
49. 94% of ransomware victims said attackers tried to compromise their backups, in a 2024 survey (Sophos, The Impact of Compromised Backups on Ransomware Outcomes). The survey covered IT and cybersecurity professionals across 14 countries.
50. 57% of attempts to compromise backups during ransomware attacks succeeded, per a 2024 survey (Sophos, The Impact of Compromised Backups on Ransomware Outcomes).
51. $3 million was the median overall ransomware recovery cost when backups were compromised, in a 2024 Sophos survey (Sophos, The Impact of Compromised Backups on Ransomware Outcomes). That was eight times higher than for organizations whose backups were not impacted.
How Do Ransomware Attacks Start and Unfold?
These figures show how attackers get in and when they strike. Ways in include malicious emails, phishing, stolen passwords and brute-force attacks, where attackers guess passwords.
52. 26% of ransomware attacks started with a malicious email and 24% with phishing, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). They were the two most common root causes.
53. 23% of ransomware attacks started with compromised credentials in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). That was the third most common root cause.
54. 18% of ransomware attacks started with an exploited vulnerability in Sophos’ 2026 survey, down from 32% in the 2025 report (Sophos, The State of Ransomware 2026). It had been the top root cause for three years.
55. 6% of ransomware attacks started with a brute force attack and 2% with a download, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
Root causes of ransomware attacks in Sophos’ 2026 survey
Source: Sophos, The State of Ransomware 2026, p. 3.
56. 79% of ransomware attacks started with an identity-based approach in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). Attackers either stole credentials or used ones already stolen.
57. 97% of victims breached through compromised credentials had multi-factor authentication (MFA) enabled in some capacity, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
58. 38% of ransomware attacks that began through a vulnerability, stolen credentials or brute force got in through an exposed application or system, in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). User devices and firewalls followed.
In Mandiant’s M-Trends report, a “prior compromise” is an intrusion where one threat group gets in through a foothold set up by a separate group (Mandiant, M-Trends 2026).
59. 30% of ransomware intrusions Mandiant investigated in 2025 began with a prior compromise, up from 15% in 2024 (Mandiant, M-Trends 2026). Exploits came next at 27%, then brute-force attacks at 20%.
60. 50% of ransomware victims with leaked credentials had a leak within 95 days before the attack, in Verizon’s 2026 DBIR (Verizon, 2026 Data Breach Investigations Report). Leaks came from infostealers or other credential exposures.
61. About 79% of ransomware cases Microsoft observed in fiscal year 2025 involved at least one remote monitoring and management (RMM) tool (Microsoft, Digital Defense Report 2025). Microsoft’s fiscal year 2025 ran from July 2024 to June 2025.
62. 88% of ransomware was launched outside business hours in Sophos cases from November 2024 to October 2025 (Sophos, 2026 Active Adversary Report). Launches were spread almost evenly across all days of the week.
How Often Do Ransomware Attackers Encrypt or Steal Data?
Ransomware attacks can lock files, steal data, or both. These figures show how often each happens.
63. 56% of ransomware attacks encrypted data in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026). In 16% of attacks, data was both encrypted and stolen.
64. 41% of ransomware attacks were stopped before data was encrypted in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
65. 57% of ransomware attacks on US organizations encrypted data, per Sophos’ 2026 US survey (Sophos, The State of Ransomware in the U.S. 2026). That is up from 51% in the 2025 report.
66. 82% of ransomware incidents Microsoft observed in its 2025 report involved large-scale data theft (Microsoft, Digital Defense Report 2025).
Sophos’ Active Adversary “cases” are 661 selected cases handled by its incident response and MDR response teams between November 1, 2024 and October 31, 2025 (Sophos, 2026 Active Adversary Report).
67. 49.77% of ransomware cases in Sophos’ 2026 Active Adversary Report included confirmed data theft (Sophos, 2026 Active Adversary Report). The cases were handled between November 2024 and October 2025.
68. 76% of the ransomware cases Coveware handled in Q2 2026 involved data theft (Coveware, Adverse cyber extortions are more common than commonly advised).
69. 70% of Coalition’s ransomware claims in 2025 involved dual extortion, combining encryption and data theft (Coalition, 2026 Cyber Claims Report announcement).
How Long Do Ransomware Attacks Go Undetected, and Who Spots Them?
These figures from Mandiant’s incident investigations show how quickly ransomware attacks are found, and who finds them.
Mandiant defines “dwell time” as the number of days an attacker is present in a compromised environment before being detected (Mandiant, M-Trends 2026).
70. Nine days was the median dwell time for ransomware-related intrusions Mandiant investigated in 2025 (Mandiant, M-Trends 2026).
71. 48.1% of ransomware-related intrusions in 2025 were identified within one week (Mandiant, M-Trends 2026). That compared with 41.5% for all intrusions Mandiant investigated.
72. 44% of ransomware victims Mandiant investigated in 2025 learned of the attack from the attackers (Mandiant, M-Trends 2026). Internal teams found 41% of cases, up from 30% in 2024.
Which Industries Are Hit Most by Ransomware?
These figures compare ransomware across industries. The FBI groups complaints by critical infrastructure sector, such as healthcare and public health, critical manufacturing, financial services and government facilities.
73. 460 ransomware complaints to the FBI in 2025 came from healthcare and public health organizations (FBI IC3, 2025 IC3 Annual Report).
Ransomware complaints to the FBI’s IC3 by critical infrastructure sector, 2025
Source: FBI IC3, 2025 IC3 Annual Report, p. 16.
74. 355 ransomware complaints to the FBI in 2025 came from critical manufacturing organizations (FBI IC3, 2025 IC3 Annual Report).
75. 258 ransomware complaints to the FBI in 2025 came from financial services organizations (FBI IC3, 2025 IC3 Annual Report).
76. More than 1,400 ransomware complaints to IC3 in 2025 came from businesses and organizations outside critical sectors (FBI IC3, 2025 IC3 Annual Report). Legal services, such as law firms, made up 18% of these complaints.
77. The top 10 ransomware variants reported to the FBI in 2025 most impacted critical manufacturing, healthcare and public health, and government facilities (FBI IC3, 2025 IC3 Annual Report).
78. 33% of leak-site ransomware victims in Q2 2026 were business services firms (Check Point Research, The State of Ransomware Report Q2 2026 (PDF)). Consumer goods and services followed at 16%, then industrial manufacturing at 12%.
Dragos’ Year in Review covers operational technology (OT) at industrial organizations, drawing mainly on its own platform, partners and third-party data; Dragos says its ransomware numbers understate the problem (Dragos, 2026 OT Cybersecurity Report: A Year in Review).
79. 3,300 industrial organizations were hit by ransomware in 2025, according to Dragos, which tracked 119 groups targeting the sector (Dragos, 2026 OT Cybersecurity Report: A Year in Review). Dragos says the real number is likely higher.
80. More than two-thirds of industrial ransomware victims in 2025 were manufacturers, according to Dragos (Dragos, 2026 OT Cybersecurity Report: A Year in Review).
Ransomware in Healthcare, Education, Retail and Other Sectors
These figures come from Sophos ransomware surveys broken down by sector, Verizon breach data and the US health regulator HHS.
81. 72% of state and local government organizations with encrypted data paid the ransom, the highest of any sector in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
82. 32% of retailers with encrypted data paid the ransom, the lowest rate of any sector in Sophos’ 2026 survey (Sophos, The State of Ransomware 2026).
Sophos’ 2025 sector reports draw on one survey of IT and cybersecurity leaders at organizations with 100 to 5,000 employees hit by ransomware in the previous 12 months (Sophos, The State of Ransomware in Healthcare 2025).
83. 29% of ransomware attacks on lower education (K-12 schools) encrypted data in Sophos’ 2025 survey, the lowest of any sector (Sophos, The State of Ransomware in Healthcare 2025). The cross-sector average was 50%.
84. 12% of ransomware attacks on healthcare providers were extortion-only in Sophos’ 2025 survey, the highest rate of any sector (Sophos, The State of Ransomware in Healthcare 2025). In these attacks, data was not encrypted but a ransom was still demanded.
85. $2.5 million was the median ransom paid by state and local government organizations in Sophos’ 2025 survey, the highest of any sector (Sophos, The State of Ransomware in Healthcare 2025). Sophos flags this group’s sample as small and indicative only.
86. $150,000 was the median ransom healthcare providers paid in Sophos’ 2025 survey, the lowest of any sector (Sophos, The State of Ransomware in Healthcare 2025). That was down from $1.47 million in the 2024 survey.
87. $2.28 million was the average recovery cost for lower education providers hit by ransomware in Sophos’ 2025 survey, the highest of any sector (Sophos, The State of Ransomware in Healthcare 2025). The figure excludes any ransom paid.
88. $3 million was the median ransom demand on financial services providers in Sophos’ 2025 survey, the highest across all industries (Sophos, The State of Ransomware in Financial Services 2025). It rose from $2 million in the 2024 survey.
89. 91% of manufacturers whose data was encrypted by ransomware got it back in Sophos’ 2025 survey, the lowest rate of any sector (Sophos, The State of Ransomware in Manufacturing and Production 2025).
90. $2 million was the median ransom demand on retailers in Sophos’ 2025 survey, double the $1 million of the 2024 survey (Sophos, The State of Ransomware in Retail 2025).
91. $800,000 was the median ransom paid by lower education (K-12) providers in Sophos’ 2025 survey, down from $6.60 million in the 2024 survey (Sophos, The State of Ransomware in Education 2025). Higher education’s median payment fell to $463K.
92. 65% of malware-related breaches in education involved ransomware, according to Verizon’s 2026 DBIR (Verizon, 2026 Data Breach Investigations Report).
93. 61% of manufacturing breaches involved ransomware, according to Verizon’s 2026 DBIR (Verizon, 2026 Data Breach Investigations Report). Malware was involved in 75% of breaches in the sector.
HHS’s breach report to Congress groups reported health data breaches by cause, and ransomware falls under “Hacking/IT Incident”. OCR investigates all reported breaches affecting 500 or more individuals (HHS OCR, Annual Report to Congress on Breaches of Unsecured PHI for CY2024).
94. About 192 million people were affected by the largest reported breach of US health information in 2024, a ransomware attack on a healthcare clearinghouse (HHS OCR, Annual Report to Congress on Breaches of Unsecured PHI for CY2024).
How Does Ransomware Affect Small Businesses?
These figures show how much of the breach and ransomware data involves smaller organizations.
Verizon’s DBIR defines “small businesses” (SMBs) as organizations with fewer than 1,000 employees (Verizon, 2026 Data Breach Investigations Report).
95. 83% of SMB breaches with a known attacker action involved ransomware, in Verizon’s 2026 DBIR (Verizon, 2026 Data Breach Investigations Report). Ransomware was the most common attacker action in these breaches, ahead of the use of stolen credentials.
96. About 96% of ransomware victims in the 2026 DBIR were small and medium-sized businesses (Verizon, 2026 Data Breach Investigations Report). This covers only cases where the organization’s size was known.
Ransomware in the UK
The UK government’s Cyber Security Breaches Survey asks businesses and charities about attacks over the past year.
DSIT’s Cyber Security Breaches Survey defines “ransomware” as malicious software that blocks access to a computer system until a ransom is paid (DSIT, Cyber Security Breaches Survey 2025/2026).
97. 1% of UK businesses were targeted by ransomware in 2025/2026, down from 3% the year before (DSIT, Cyber Security Breaches Survey 2025/2026).
98. 7% of large UK businesses and 3% of medium ones were targeted by ransomware in 2025/2026 (DSIT, Cyber Security Breaches Survey 2025/2026). That compares with 1% of businesses overall.
99. 1.3% of UK micro businesses and 1.7% of small businesses were targeted by ransomware in 2025/2026 (DSIT, Cyber Security Breaches Survey 2025/2026 data tables). In the same table, the figure for all UK businesses is 1.48%.
100. 4% of high-income UK charities were targeted by ransomware in 2025/2026, versus 1% of all charities (DSIT, Cyber Security Breaches Survey 2025/2026).
DSIT’s Cyber Security Breaches Survey counts a ransomware attack as a cyber crime only where a financial ransom was demanded (DSIT, Cyber Security Breaches Survey 2025/2026).
101. About 9,000 UK businesses and 1,000 charities experienced ransomware cyber crime in 2025/2026, DSIT estimates (DSIT, Cyber Security Breaches Survey 2025/2026).
102. 3% of UK businesses that suffered cyber crime in 2025/2026 faced ransomware cyber crime (DSIT, Cyber Security Breaches Survey 2025/2026). For charities hit by cyber crime, the figure was 5%.
103. 2% of UK businesses that identified a breach or attack in 2025/2026 paid a ransom (DSIT, Cyber Security Breaches Survey 2025/2026). Among charities with a breach or attack, it was 1%.
Ransomware in Canada and Australia
These figures come from Statistics Canada, the Canadian Centre for Cyber Security and the Australian Signals Directorate.
Statistics Canada’s category “incidents to steal money or demand ransom payment” covers both theft and ransom demands; small firms have 10 to 49 employees (Statistics Canada, Table 22-10-0076-01).
104. 5.9% of Canadian businesses were hit by incidents to steal money or demand ransom in 2023 (Statistics Canada, Table 22-10-0076-01).
105. 11.9% of large Canadian businesses faced money-theft or ransom incidents in 2023, versus 4.8% of small ones (Statistics Canada, Table 22-10-0076-01). Medium-sized businesses sat at 10.6%.
106. 26% was the average yearly increase in Canadian ransomware incidents known to the Cyber Centre from 2021 to 2024 (Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025-2027).
107. 336 pre-ransomware warnings went to over 300 Canadian organizations in fiscal 2024–25 (Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025-2027). The Cyber Centre puts the economic savings at up to CAD 18 million.
108. 138 ransomware incidents were handled by the Australian Cyber Security Centre (ACSC), part of ASD, in FY2024–25 (ASD, Annual Cyber Threat Report 2024–2025). In 39% of them, ASD first contacted the victim to warn of a possible incident.
109. 11% of cyber incidents Australia’s ASD responded to in FY2024–25 involved ransomware (ASD, Annual Cyber Threat Report 2024–2025). That share was unchanged from the year before.
Ransomware in the EU, Germany and Japan
These figures come from ENISA, the EU’s cybersecurity agency, and from police and cyber agencies in Germany and Japan.
ENISA’s “Threat Landscape 2025” counts incidents from open sources and EU member-state sharing, covering July 2024 to June 2025 (ENISA, Threat Landscape 2025).
110. 81.1% of cybercrime activities targeting EU organisations were ransomware, ENISA found for July 2024–June 2025 (ENISA, Threat Landscape 2025). Cybercrime made up 13.4% of all incidents ENISA analysed.
111. 23.4% of leak-site and forum claims of ransomware and data breaches in EU countries named Germany, ENISA reports (ENISA, Threat Landscape 2025). Italy, Spain, France and Belgium followed.
112. 950 ransomware attacks were reported to German police in 2024, down from 1,018 in 2023 (BKA, Bundeslagebild Cybercrime 2024).
113. Over 80% of ransomware attacks reported to police in Germany in 2024 targeted small and medium-sized enterprises (SMEs), counting only cases where size was recorded (BKA, Bundeslagebild Cybercrime 2024).
114. 78 presumed victims from Germany were named on leak sites in Q1 2025, a new all-time high per BSI (BSI, Die Lage der IT-Sicherheit in Deutschland 2025). BSI says the record was partly due to repeat leaks of the same victims.
Japan’s National Police Agency defines “ransomware” as malware that encrypts data and demands money or crypto to decrypt it; it counts encryption-free “no-ware ransom” separately (National Police Agency, Cyberspace threat situation in 2025).
115. 226 ransomware cases at companies and other organisations were reported to Japan’s National Police Agency in 2025 (National Police Agency, Cyberspace threat situation in 2025). The agency says the number remains at a high level.
116. 143 of Japan’s 226 reported ransomware cases in 2025 hit small and medium-sized enterprises (National Police Agency, Cyberspace threat situation in 2025). Large companies accounted for 64 cases and other organisations for 19.
117. 136 of 153 Japanese ransomware cases with a known method in 2025 used double extortion (National Police Agency, Cyberspace threat situation in 2025).
Conclusion
Ransomware is still a common part of data breaches. Fewer victims pay than a few years ago, but recovery remains expensive. Attackers keep changing how they get in. We’ll update this page as new data comes out.