Ransomware economics show downtime and exfiltration drive impact

At a glance

What this is: This is a ransomware statistics roundup showing that attack frequency, exfiltration and recovery costs remain high, with downtime and sector targeting shaping real-world impact.

Why it matters: It matters because ransomware resilience is not just a backup problem: identity, segmentation, privileged access and device control all affect how far an intrusion can move before business operations stop.

By the numbers:

• A ransomware attack occurs approximately every 11 seconds globally.
• 72% of organizations experienced ransomware attempts in 2025.
• The average ransom payment in 2025 reached $1.82 million.
• The average ransomware recovery cost exceeds $2.73 million.

Context

Ransomware is not a single event but a business model built around speed, disruption and leverage. The attacker’s objective is to force a rapid decision by taking systems offline, stealing data, or both, then monetising the pressure created by operational downtime.

For IAM, PAM and NHI programmes, the relevance is direct: ransomware campaigns commonly rely on credential abuse, lateral movement and privileged access once initial footholds exist. For cyber resilience teams, the article reinforces that recovery cost is only part of the problem, because exfiltration, production loss and regulatory exposure often dominate the real impact.

The data shows that organisations in high-urgency sectors such as healthcare and manufacturing face a governance problem as much as a malware problem. When the business cannot tolerate delay, control gaps around access scope, segmentation and device visibility become decisive.

Key questions

Q: What breaks when privileged access is too broad in a ransomware attack?

A: Broad privileged access turns a single endpoint compromise into cross-server movement, credential harvesting, and recovery disruption. Attackers can reach vaults, backups, and administration tools from the same trust zone, which makes containment slow and expensive. The practical fix is to shrink session reach and remove standing privilege before an incident tests it.

Q: Why do ransomware attacks keep creating such expensive recovery and business disruption costs?

A: Ransomware creates high cost because it stops operations, forces recovery work, and can still leave organisations without full data restoration even after payment. The expense is not only the ransom itself. Teams also absorb downtime, forensic work, legal exposure, customer loss, and longer term trust damage when critical systems are unavailable.

Q: What are the signs that ransomware containment controls are not working?

A: Warning signs include multiple systems being infected from one initial compromise, critical services going offline for extended periods, and recovery taking days rather than hours. If teams cannot see traffic flows across hybrid environments or cannot isolate infected assets quickly, containment is not keeping pace with attacker movement. That usually means segmentation and response processes need tightening.

Q: How should organisations prepare for ransomware in high-downtime sectors?

A: Organisations in healthcare, manufacturing and similar environments should build response plans around continuity, not only restoration. That means identifying which systems must stay operational, limiting the identities that can reach them, and testing segmentation under failure conditions. If critical services cannot be isolated from the rest of the estate, recovery will remain slow and expensive.

Technical breakdown

Why ransomware economics favour speed over stealth

Modern ransomware operations are optimised for fast disruption, not long dwell time. Attackers often combine initial access with rapid credential abuse, lateral movement and encryption before defenders can intervene. In many cases, the extortion event is amplified by data theft, because the attacker can pressure the victim twice: once through service outage and again through disclosure risk. Ransomware-as-a-Service has also lowered the barrier to entry, which increases attack volume and makes opportunistic targeting more common. Practical implication: shorten the time between suspicious access and containment so the adversary cannot convert a foothold into business interruption.

Practical implication: detect and isolate suspicious access before the attacker reaches shared admin paths or backup systems.

How exfiltration changes ransomware from encryption to extortion

Encryption alone is no longer the whole threat. When attackers steal data first, recovery becomes a legal, privacy and reputational problem even if backups restore systems. That is why exfiltration appears in so many ransomware incidents and why recovery cost often exceeds the ransom itself. Exposed credentials, overprivileged service accounts and weak segmentation all make it easier for attackers to reach data stores before detonation. In identity terms, the issue is not only who can log in, but what a stolen or abused account can reach once inside. Practical implication: treat data-access scope and privilege boundaries as ransomware controls, not just governance hygiene.

Practical implication: narrow the blast radius of any compromised identity so stolen credentials cannot reach crown-jewel data.

Why downtime is the real force multiplier in ransomware

The damage from ransomware is often driven less by the malware itself than by the interruption it creates across operations, production and service delivery. Manufacturing, healthcare and critical infrastructure are especially exposed because the cost of halting processes rises quickly, and restoration must often be sequenced around safety and regulatory constraints. Downtime also gives attackers leverage to push payment decisions before full forensic validation is complete. This is why business continuity, segmentation and privileged access containment belong in the same control conversation. Practical implication: design control planes that keep essential services running even when part of the environment is compromised.

Practical implication: build containment and recovery paths that preserve critical services while the infected segment is isolated.

Threat narrative

Attacker objective: The objective is to maximise leverage by combining data theft with business interruption so the victim faces both recovery cost and disclosure risk.

1. Entry typically begins with credential theft, exposed remote access or another foothold that gives the operator a foothold inside the network.
2. The attacker then abuses standing privilege or weak segmentation to move laterally, reach data stores and prepare the environment for encryption and exfiltration.
3. The final stage is operational disruption plus extortion, where stolen data and locked systems are used together to increase payment pressure.

Breaches seen in the wild

• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware is increasingly an identity problem wrapped inside a malware event. The article’s own numbers show that exfiltration, downtime and recovery cost dominate the economics, which means the attacker’s leverage comes from access, not just payload delivery. That shifts the governance question toward who can move laterally, who can reach sensitive systems, and which accounts remain usable after first contact. Practitioners should treat identity scope as part of ransomware preparedness, not a separate programme.

Standing privilege remains one of the most dangerous assumptions in ransomware defence. Once an attacker acquires a reusable account, the difference between a contained incident and a major outage is often whether that identity can traverse shared systems, backup planes and production segments. This is where IAM, PAM and network segmentation intersect in a way many programmes still underestimate. The practical conclusion is that persistent high-value access should be viewed as a recoverable failure condition, not an acceptable operating state.

Manufacturing and healthcare expose a clear resilience gap that many governance models still underweight. These sectors are not only targeted more often, they also suffer disproportionate operational harm when systems stop, which makes governance around device visibility, privileged access and recovery sequencing non-negotiable. The security issue is not simply ransomware volume but the inability to absorb interruption without cascading business impact. Practitioners should prioritise controls that reduce blast radius before they optimise restoration speed.

Blast-radius control is the decisive variable in ransomware resilience. The article shows that recovery costs remain high even where organisations refuse to pay, so the meaningful question is how far an intrusion can travel before it is isolated. That makes segmentation, least privilege and device intelligence materially more important than headline recovery metrics. The organisations that fare better are usually the ones that limit lateral movement early, not the ones that only plan to rebuild quickly.

Data exfiltration turns ransomware into a governance failure as much as a security failure. When stolen data is used alongside encryption, response teams must handle containment, legal exposure and operational restoration at the same time. That combination rewards organisations that know where sensitive data lives, which identities can touch it, and how quickly access can be revoked under pressure. The practitioner lesson is to govern access paths with the assumption that breach and extortion arrive together.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Ransomware preparedness is increasingly measured by how quickly an organisation can stop an attacker from turning a foothold into lateral movement. The practical test is whether a stolen account, unmanaged endpoint or exposed remote access path can still reach backup, production or privileged administration zones.

Blast-radius control: the next phase of ransomware defence is not only restoration speed but the ability to prevent compromise from spreading into systems that keep the business running. That means access boundaries, device visibility and segmentation need to be designed together, not managed as separate workstreams.

For practitioners

• Constrain lateral movement paths Map the identities, service accounts and device relationships that let ransomware spread across production, backup and management networks, then remove unnecessary trust links.
• Reduce standing privilege before incidents Review privileged accounts, remote admin access and service credentials that remain valid outside active tasks, and retire persistent access wherever possible.
• Segment critical operational environments Separate medical, production and business systems so an intrusion in one zone cannot automatically reach high-value data stores or recovery infrastructure.
• Harden recovery paths against extortion Test whether backups, restore controls and emergency access remain available when primary directories, admin consoles or endpoint tooling are compromised.
• Inventory unmanaged devices and hidden access paths Use device intelligence to find endpoints, IoT assets and other unmanaged systems that can become initial footholds or propagation routes during ransomware activity.

Key takeaways

• Ransomware economics now hinge on access scope, operational disruption and data theft, not just the encryption payload itself.
• The article’s statistics show that attack attempts are frequent, recovery costs remain high and certain sectors face disproportionate targeting and downtime.
• The strongest defence is to limit lateral movement, reduce standing privilege and preserve recovery paths that do not collapse with production access.

Key terms

• Ransomware-as-a-Service: A criminal operating model where ransomware developers provide tooling, infrastructure, and support to affiliates who carry out attacks. This model lowers the barrier to entry for attackers and increases scale, making identity-based entry points more attractive and more frequently targeted.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Data Exfiltration: The unauthorized removal of data from an environment. In ransomware campaigns it often happens before encryption, turning a pure availability incident into a combined confidentiality, legal and extortion problem.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners translate identity controls into resilience when attacks target access paths and privileged workflows.