Ransomware Statistics Guide: Frequency, Payments, Recovery and Entry Points

Ransomware figures disagree wildly because each publisher measures something different: survey respondents, incident response caseloads, blockchain payments or complaints to law enforcement. This page brings together the latest ransomware statistics from the primary publishers, Sophos, Coveware, Chainalysis, the FBI Internet Crime Complaint Center (IC3), Verizon, IBM, the UK NCSC and the UK government's Cyber Security Breaches Survey, and explains what each one can and cannot tell you. Every figure carries its report name, publisher and edition or period in the same sentence or table row; anything we could not trace to the publisher's own page is left out. It is for security leaders, incident responders and risk teams who need defensible numbers for planning, budgets and tabletop exercises. Last reviewed: October 2026.

Key takeaways

• Fewer victims pay. Chainalysis estimates only about 28% of victims paid in 2025, a record low, and the Verizon 2026 DBIR finds 69% of ransomware victims in its dataset did not pay.
• Payments total hundreds of millions, not billions. Chainalysis tracked more than $820 million in on-chain ransomware payments in 2025, down about 8% from a revised $892 million in 2024, while claimed victims on leak sites rose about 50%.
• Identity is the common entry point. The Sophos State of Ransomware 2026 reports that 79% of attacks began with an identity-based approach, and malicious email, phishing and compromised credentials were the top three root causes.
• Backups decide recovery. Sophos 2026 finds 66% of organisations with encrypted data restored from backups, up 12 points, and 55% were fully recovered within a week.
• Ransomware dominates breach caseloads but is rare across all businesses. It appears in 48% of breaches in the Verizon 2026 DBIR, yet only 1% of UK businesses reported it in the Cyber Security Breaches Survey 2025/2026.

Headline statistics

Statistics by theme

Frequency and prevalence

• Share of breaches: the Verizon 2026 Data Breach Investigations Report finds ransomware in 48% of breaches, up from 44%. The report says small organisations are disproportionately affected.
• Share of incidents in a cost sample: the IBM Cost of a Data Breach Report 2026 records ransomware in 39% of incidents among its 602 breached organisations, up from 34%.
• Leak-site volume: Chainalysis, citing eCrime.ch, reports claimed ransomware victims rose about 50% in 2025, which it calls the most active year on record. Chainalysis cautions that some leak-site claims are not genuine and that a listing does not prove the victim refused to pay.
• Complaints to US law enforcement: the FBI 2025 IC3 Annual Report counts 3,611 ransomware complaints and identifies Critical Manufacturing, Healthcare and Public Health, and Government Facilities as the most affected critical infrastructure sectors.
• UK prevalence: the Cyber Security Breaches Survey 2025/2026 (UK DSIT) puts ransomware at 1% of businesses, down from 3% in each of the two previous years.
• UK national incidents: the NCSC Annual Review 2025, covering September 2024 to August 2025, reports 429 incidents handled, of which 204 were nationally significant (89 the year before) and 18 highly significant, an increase of almost 50%. The NCSC release does not break these down by ransomware. The Marks and Spencer Cyberattack 2025 and Jaguar Land Rover Cyberattack 2025 fall in this period.

Payments and ransom amounts

• Why the medians differ: Chainalysis medians cover every traced payment, including small ones, while Sophos surveys organisations of 100 to 5,000 employees. Sophos 2026 also notes its demand and payment medians come from different samples (1,214 demands, 530 payments); where both were known, the median payment was 90% of the demand and 51% of payers paid less than asked.
• Averages are skewed: Coveware attributes the 176% rise in the Q2 2026 average to a few large data-exfiltration payments, while the median fell 50%. Use medians for planning.
• Losses reported to the FBI understate cost: the 2025 IC3 report records $32,320,105 in ransomware losses and states that the figure does not normally include lost business, time, wages, files or equipment.
• For legal limits on paying, see the Ransomware Payments and Sanctions Guide and the Ransomware Negotiation Guide.

Entry points and root causes

• Identity first: Sophos 2026 reports 79% of attacks began with an identity-based approach, and 97% of victims hit through compromised credentials had MFA enabled in some form, which points to weak or bypassable MFA rather than none.
• Quarterly trend: Coveware's Q2 2026 report says phishing and social engineering returned to the top of its vector list, followed by identity-based access abuse, while remote access compromise fell from its late-2025 peak and vulnerability exploitation declined.
• Operational gaps: Sophos 2026 attributes attacks to security gaps (62% of victims cited known or unknown gaps), lack of people or skills (58%) and missing or poor protection (57%).
• Cheap access: Chainalysis cites Darkweb IQ data showing the average price of victim network access fell from about $1,427 in Q1 2023 to about $439 in Q1 2026, and initial access brokers took at least $14 million on-chain in 2025.
• Case evidence: the Change Healthcare Breach 2024 began with a Citrix login without MFA, and Marks and Spencer described social engineering and impersonation of an individual combined with a third-party vector. See the Top 10 Ransomware Initial Access Vectors.

Encryption, data theft and extortion

• Encryption rate: Sophos 2026 finds data was encrypted in 56% of attacks (40% encrypted only, 16% encrypted and stolen), 41% were stopped before encryption, and 2% were extortion without encryption.
• Exfiltration is near universal in IR cases: Coveware's Q2 2026 report observed data exfiltration in 76% of cases, tied with lateral movement as the most common tactic.
• Pressure tactics: the IBM Cost of a Data Breach Report 2026 lists brand reputation (41%), employee data (35%) and intellectual property (31%) as the main levers attackers used.
• Paying does not end it: Coveware's Q2 2026 report documents paid ransoms that did not lead to data deletion and stolen data re-extorted by another group. See the Data Extortion Without Encryption Guide.

Recovery and impact

• Backups: Sophos 2026 finds 66% of organisations with encrypted data used backups, up 12 points, and 48% paid the ransom to recover data.
• Recovery cost: Sophos 2026 reports a mean recovery cost of $1,700,200 excluding ransom, up 11%, and a median of $375,000.
• Recovery time: 55% of Sophos 2026 respondents were fully recovered within one week.
• People: 99% of Sophos 2026 victims with encrypted data reported consequences for their IT or security teams, most often anxiety about future attacks (41%) and pressure from senior leaders (40%).
• Operational disruption at scale: Jaguar Land Rover halted production from 1 September to a phased restart on 8 October 2025, and the Cyber Monitoring Centre estimated the cost to the UK economy at £1.9 billion. See the Ransomware Response and Recovery Guide.

Victims and groups

• Most reported variants to the FBI: the 2025 IC3 report lists Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SAFEPAY and Medusa as the top ten, together 56.8% of ransomware incidents reported to it.
• Coveware market share, Q2 2026: lone-wolf actors 17%, ShinyHunters 12%, Akira 9%, The Gentlemen 8% and DragonForce 4%.
• Victim size and sector: Coveware's Q2 2026 median victim had 750 employees; software services (17.2%), healthcare (14.1%) and professional services (13.1%) were the most affected sectors.
• See the Ransomware Groups Guide, the Akira Threat Actor Profile and the Play Ransomware Profile.

What the numbers mean for defenders

• Small versus large organisations: the Verizon 2026 DBIR says small organisations are hit disproportionately, and Coveware's median victim has 750 employees. Smaller firms get most value from MFA, patching edge devices, immutable backups and an outsourced response retainer; larger ones from segmentation, privileged access control and tested recovery at scale. See the Incident Response Retainer Buyer's Guide.
• Where identity fits: backup consoles, hypervisor admin and service accounts are prime targets, and stolen machine credentials let attackers move without malware. See the Backup Identity Isolation Guide and the Identity Attack Statistics Guide.
• Decide payment policy before the incident: with payment rates falling and re-extortion documented, write down who decides, on what evidence, and under which legal constraints. See the Ransomware Playbook Template.

Metrics that show ransomware resilience is improving:

• Restore success rate: share of critical systems restored from backup within target time in the last test.
• Phishing-resistant MFA coverage: on remote access, email, backup consoles and privileged accounts.
• Time to patch internet-facing critical flaws: median days, with KEV items tracked separately.
• Time to isolate: minutes from encryption-behaviour alert to host isolation in exercises and real events.
• Exfiltration alerts triaged: share of bulk-transfer alerts reviewed within one hour.
• Recovery time objective met: share of business services recovered within agreed RTO in the last exercise.

Common failure patterns when using ransomware statistics

• Comparing medians from different populations: Chainalysis ($59,556), the DBIR ($139,875), Coveware ($150,000) and Sophos ($769,000) measure different victims. Never average them.
• Reading leak-site counts as attack counts: Chainalysis warns that some claims are false and listings do not prove non-payment.
• Treating payments as the cost: Sophos 2026 recovery costs ($1.7 million mean) exceed most ransom medians, and the M&S estimate of a £300 million profit impact dwarfs any payment.
• Assuming any MFA is enough: 97% of Sophos credential-based victims had MFA in some form. Coverage and phishing resistance matter.
• Relying on untested backups: a third of encrypted victims in Sophos 2026 did not recover from backups; attackers target backup systems deliberately.

Methodology notes and caveats

• Vendor figures are the vendor's: Sophos, Coveware and Chainalysis sell products or services related to ransomware. Their data is widely used, but samples reflect their customers and methods.
• Survivorship in surveys: Sophos surveys organisations hit in the past year and able to respond; firms that closed are absent.
• Revisions: Chainalysis raised its 2024 total from $813 million to $892 million as more payments were attributed; expect the 2025 figure to rise too.
• Refresh cycle: Chainalysis publishes early in the year, IC3 in spring, Verizon in spring, Sophos mid-year, Coveware every quarter and the NCSC each autumn.
• Official guidance is not statistics: CISA's #StopRansomware guide gives controls and reporting routes, not counts. Use it for the response, not the numbers.

Practitioner checklist

• Quote each ransomware figure with publisher, report and period, and say which population it measures.
• Use medians, not averages, for payment and recovery cost planning.
• Enforce phishing-resistant MFA on remote access, email, backup and hypervisor consoles.
• Patch internet-facing and KEV-listed vulnerabilities first, and retire unused remote access.
• Keep offline or immutable backups with separate credentials and test restores quarterly.
• Monitor egress for bulk data transfer, since exfiltration precedes most extortion.
• Agree a payment decision process and legal checks before an incident.
• Report incidents to CISA, the FBI or IC3 in the US, or to the NCSC in the UK.
• Recheck these figures after each publisher's next release.

Standards and references

• CISA: #StopRansomware Guide
• FBI: 2025 IC3 Annual Report
• NCSC: Annual Review 2025 announcement
• UK DSIT: Cyber Security Breaches Survey 2025/2026
• Verizon: 2026 DBIR Executive Summary
• Sophos: The State of Ransomware 2026
• Chainalysis: Ransomware payments in 2025
• Coveware: Q2 2026 quarterly report

Related NHI Mgmt Group resources: Cybersecurity Statistics Guide · Ransomware Prevention Guide · Incident Response Guide · Data Breach Statistics Guide · Backup Security and Immutable Backup Guide