Ransomware Statistics (2026): 55+ Data Points on Attack, Financial Fallout, Recovery

Ransomware attacks surged 50% year-over-year in 2025 to nearly 7,900 publicly claimed incidents, even as the share of victims paying ransoms collapsed to an all-time low of 28% (Chainalysis, 2026 Crypto Crime Report). 

The average total cost of a ransomware incident now runs 5.08 million when downtime, remediation, and lost business are tallied (IBM cost of a Data Breach Report 2025; Huntress, 2026).

Meanwhile, 7074 billion this year, the numbers below are the ones boards, security teams, and policymakers will reference all year.

Key Takeaways:✎…

Ransomware attacks rose 50% in 2025 to 7,874 publicly claimed incidents, and Q1 2026 is running more than 30% above the 2025 monthly average (NCC Group Threat Intelligence Report 2026; Cyble Threat Landscape Report January 2026). 

Only 28% of victims paid a ransom in 2025, down from 62.8% in 2024 — the lowest rate on record (Chainalysis, 2026 Crypto Crime Report).

86% of Coalition policyholders refused to pay any ransom in 2025, with UK policyholders restoring their systems with no ransom demands needing to be paid (Coalition, 2026 Cyber Claims Report). 

The median ransom payment surged 368% to $59,556 — meaning fewer victims paid, but those who did paid dramatically more (Chainalysis, 2026 Crypto Crime Report). 

Total on-chain ransomware payments fell 8% to $820 million in 2025 despite the attack surge (Chainalysis, 2026 Crypto Crime Report). 

Average initial ransom demands jumped 47% to over 16 million (Coalition, 2026 Cyber Claims Report). 

The average total cost per ransomware incident is $5.08 million — including downtime, remediation, lost revenue, and legal costs (IBM / Multiple, 2025–2026).

**Average recovery cost, excluding ransom, is 1.53 million, down 442.73 million in 2024 (Sophos State of Ransomware 2025).

70% of ransomware attacks now use double extortion, combining encryption with data theft and leak threats (Coalition, 2026 Cyber Claims Report).

88% of SMB breaches involved ransomware in 2025, more than double the 39% rate at large enterprises (Verizon 2025 DBIR). 

Global cybersecurity spending is forecast to reach $244 billion in 2026, a 13.3% year-over-year increase (Gartner, February 2026). 

December 2025 set a two-year monthly record with 1,004 ransomware incidents recorded on the dark web (NordStellar, January 2026).

Part 1. Attack Frequency & Volume

Overall Growth Trajectory

2025 shattered every prior record for ransomware activity, and 2026 opened at the same elevated pace. The numbers no longer show cyclical spikes — they reflect a structurally higher baseline. Multiple independent data sources converge on the same conclusion: ransomware is more frequent, more industrialized, and shows no sign of deceleration.

The outlier that commands attention: December 2025 alone produced 1,004 dark web cases — a single-month figure that would have represented an entire quarter’s activity just two years ago. By April 2026, The Gentlemen RaaS group had already publicly listed over 320 victims on its data leak site, with 240 occurring in 2026 alone (Check Point Research, April 2026).

Geographic Distribution

The United States remains, by an overwhelming margin, the most targeted nation — a function of its concentration of wealth, digital infrastructure, and high cyber insurance penetration.

North America accounted for 81% of attacks observed. The disproportionate targeting of anglophone economies — particularly the US, Canada, and UK — reflects threat actors’ preference for developed markets where ransomware disruption carries maximum financial leverage.

Most Active Ransomware Groups

2025 marked the definitive end of the LockBit era. Sustained international law enforcement action knocked LockBit 3.0 — 2024’s most prolific group — entirely out of the top 10. In its place, Qilin established dominance, linked to over 1,000 attacks. The ransomware ecosystem has simultaneously fragmented: analysts now track 85 active extortion groups, up from a small handful of dominant strains just two years ago.

The top 20 groups responsible for nearly 70% of all claims in 2025: Qilin (15%), Akira (10%), CL0P (6%), PLAY (5%), SAFEPAY (5%), INC RANSOM (5%), Lynx (3%), RansomHub (3%), DragonForce (3%), Sinobi (2%), and others (Analyst1, 2025 Year in Review).

Part 2. The Economics of Ransomware

Ransom Demands & Payments

The ransomware economy is undergoing a fundamental re-pricing. While aggregate payments declined 8% to 820 million in 2025, the median payment exploded 36860,000. Fewer victims are paying, but those who do face demands that have never been higher. This is not a sign of ransomware’s decline — it is a sign of its maturation. Attackers are consolidating around higher-value targets and extracting maximum value from the shrinking pool of payers.

Ransom Demands vs Payments 2023-2025:

The 86% refusal rate among Coalition policyholders — including 100% refusal among UK policyholders — signals a structural shift. Organizations are investing more in detection, hardened backups, and incident response capability rather than budgeting for ransom payments. As one insurance executive noted, “Backup strategies are working, and ransomware gangs are responding with data theft” (Coalition, 2026 Cyber Claims Report).

The True Cost: Downtime & Recovery

The ransom payment is the least of a victim’s financial worries. Recovery costs, even excluding any ransom, now average 1.53 million. Total incident costs – including downtime, lost revenue, legal fees, regulatory penalties, and reputational harm – reach 5.08 million on average.

 The calculus is clear: the ransom is 7x smaller than the total attack cost, as Check Point Research estimates the total cost of an attack to the victim is seven times higher than what they pay to cybercriminals (CPR, March 2026).

For organizations that need to restore operations rapidly, automated backup and disaster recovery solutions can dramatically compress recovery timelines. Zero organizations in the Absolute Security survey recovered within a single day, underscoring the gap between recovery ambition and operational reality.

The Cyber Insurance Dimension

Cyber insurance markets tightened further in 2025, with carriers demanding higher security maturity as a precondition for coverage. The global cyber insurance market is projected to reach $22.5 billion in 2026 (Medhacloud / industry estimates).

Ransomware accounted for 21% of all cyber insurance claims in 2025, with frequency flat at 0.32% but severity dropping 19% to an average loss of $262,000 (Coalition, 2026 Cyber Claims Report).

Part 3. Industry Impact

Healthcare

Healthcare remains ransomware’s most profitable and consistent target. The sector’s high payment rates — 68–72% in healthcare versus approximately 40% in other sectors — create a self-reinforcing cycle that keeps attackers returning. A healthcare organization faces a cyberattack roughly every 10 hours, according to analysis of 592 incidents across 94 ransomware groups between January 2025 and February 2026.

A clear pattern emerges across healthcare incidents: attackers exploit vulnerabilities already listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. “Attackers are walking through doors that were left open — and getting paid for it,” said Dr. Srinivas Mukkamala, CEO of Securin. For organizations holding sensitive patient data, implementing a comprehensive backup and disaster recovery strategy is no longer optional — it is a regulatory and operational imperative.

Manufacturing & Critical Infrastructure

Manufacturing and industrial sectors bore the brunt of ransomware by sheer volume in 2025, with industrials accounting for 28% of all recorded incidents. The convergence of IT and operational technology (OT) creates uniquely dangerous attack surfaces where ransomware can halt production lines, not just encrypt files.

The manufacturing sector’s improved ability to stop attacks before encryption — 50% intercepted pre-encryption — represents a rare bright spot. But attackers have adapted: extortion-only attacks, which skip encryption entirely in favor of data theft and public leak threats, rose from 49% of claims in H1 2025 to 65% in H2 2025 (Resilience, February 2026).

Education & Government

Education and government sectors face a double burden: they hold sensitive personal data while operating on constrained budgets with aging infrastructure. Government agencies experienced the highest volume of cyberattack campaigns in 2025, while the education sector saw attacks rise 63% year-over-year.

Public administration and healthcare tied as the most targeted verticals in Q1 2026, each accounting for 24% of Cisco Talos IR engagements — the third consecutive quarter public administration led the list (Cisco Talos, Q1 2026 IR Trends Report).

Part 4. Attack Tactics & Evolution

One of the most consequential tactical shifts of 2025 is the rise of data-theft-only extortion, which bypasses encryption entirely. The percentage of extortion-only attacks rose from 49% in the first half of 2025 to 65% in the second half, according to cyber risk firm Resilience. This fundamentally changes the defense equation: backups, long the gold standard for ransomware recovery, cannot prevent data extortion when attackers steal data without ever deploying encryption.

The collapse in hand-off time — from over eight hours in 2022 to just 22 seconds in 2025 — represents an industrialization of the attack supply chain. Initial access brokers (IABs), who sell compromised network access to ransomware operators, earned approximately 1,427 in Q1 2023 to just $439 in Q1 2026, reflecting automation, AI-assisted tooling, and oversupply (Chainalysis, 2026 Crypto Crime Report).

Part 5. Data Loss & Recovery Realities

The gap between organizations’ confidence in their recovery capabilities and their actual outcomes is widening dangerously. While 90% of cybersecurity leaders express confidence they can recover quickly from a cyber incident, only 28% of organizations hit by ransomware were able to fully restore all their data. On average, organizations recover just 72% of affected data after a ransomware incident.

Confidence vs Reality Gap in Data Recovery 2025-2026:

The data reveals a brutal arithmetic: paying the ransom is neither a guarantee of recovery nor the fastest path. Only 54% of organizations with encrypted data successfully restored from backups — the lowest backup effectiveness rate in six years, as attackers have become significantly better at finding and neutralizing backup infrastructure before deploying encryption (Sophos State of Ransomware 2025). For organizations evaluating their data resilience posture, investing in a hardened, immutable backup solution with regular recovery testing can mean the difference between a 24-hour disruption and a multi-week outage.

Part 6. The SMB Burden: Disproportionate and Growing

Small and medium-sized businesses are not collateral damage in ransomware campaigns — they are the primary target. 88% of SMB breaches in 2025 involved ransomware, more than double the 39% rate observed at large enterprises. The asymmetry is stark: SMBs face roughly 4x as many confirmed breaches as large organizations while operating with a fraction of the security resources.

SMB and Enterprise Ransomware Burden 2025:

The Mastercard survey of over 5,000 SMB owners found that almost one in five who experienced a cyberattack went bankrupt or went out of business, and 80% spent significant time rebuilding trust with customers and partners (Mastercard SMB Cybersecurity Study, 2025). The widely cited statistic that “60% of small businesses close within 6 months of an attack” has been officially debunked by the National Cybersecurity Alliance — but the real numbers remain alarming enough without embellishment.

For SMBs without dedicated security teams, outsourcing security monitoring and backup management to managed service providers reduces ransomware risk by up to 60% compared to self-managed environments (Medhacloud, 2026).

Part 7. Law Enforcement & Disruption Efforts

International law enforcement operations scaled significantly in 2025, targeting not just individual ransomware groups but the infrastructure layer that enables them. INTERPOL’s Operation Synergia III dismantled over 45,000 malicious IP addresses and servers across 72 countries between July 2025 and January 2026, leading to 94 arrests with 110 more individuals under investigation.

Law Enforcement Actions Against Ransomware: 2025–2026:

The FBI identified 63 new ransomware variants in 2025, with Akira, Qilin, RansomHub, LockBit, and Medusa having the greatest impact on critical sectors including healthcare, manufacturing, and government facilities (FBI IC3 Annual Report 2025). The Play ransomware group alone breached approximately 900 organizations as of May 2025 — a 3x increase from the 300 reported in October 2023 (CISA/FBI Joint Advisory).

Ransomware & Data Loss by the Numbers: Summary Table

Methodology and Sources:

This report prioritizes primary-source data from original research reports, surveys, government filings, academic papers, and official company disclosures. All statistics were cross-referenced against at least one independent source where possible. We applied a recency standard prioritizing 2025–2026 data; figures older than 2024 are explicitly flagged as “most recent available.” Market size projections and growth rates were verified across two or more independent research firms. Where survey-based statistics are cited, we have noted sample sizes and methodology caveats (e.g., self-reported data) in context. No statistic in this report was invented, rounded for dramatic effect, or derived from unverifiable claims.

Primary sources cited:

• Chainalysis — 2026 Crypto Crime Report
• Coalition — 2026 Cyber Claims Report
• Sophos — State of Ransomware 2025; State of Ransomware in Manufacturing 2025; State of Ransomware in Healthcare 2025
• IBM — Cost of a Data Breach Report 2025
• Cyble — Annual Threat Landscape Report 2025; January 2026 Threat Landscape Report
• NCC Group — 2026 Threat Intelligence Report
• NordStellar — Ransomware Research, January 2026
• Mandiant (Google Cloud) — M-Trends 2026
• BakerHostetler — 2025 Data Security Incident Response Report
• Veeam — Data Trust & Resilience Report 2026
• Verizon — 2025 Data Breach Investigations Report (DBIR)
• Absolute Security — Global Cyber Resilience Survey, January 2026
• FBI — Internet Crime Complaint Center (IC3) Annual Report 2025
• INTERPOL — Operation Synergia III, March 2026
• Cisco Talos — IR Trends Q1 2026
• Securin — Healthcare Threat Intelligence Report, April 2026
• Dragos — Industrial Ransomware Analysis, February 2026
• Analyst1 — 2025 Year in Review: Ransomware & Extortion Activity
• HPE Threat Labs — 2025 Campaign Analysis, March 2026
• Gartner — Forecast: Information Security Worldwide, February 2026
• DataNumen — Data Loss Statistics Report 2025
• BlackFog / Vectra AI — Ransomware Data Exfiltration Analysis, February 2026
• Resilience — Cyber Risk Report, February 2026
• Coveware by Veeam — Q3 2025 Ransomware Report
• Mastercard — SMB Cybersecurity Study 2025
• Comparitech — US Healthcare Ransomware Analysis 2025; Education Sector Ransomware 2025
• Check Point Research — The Gentlemen RaaS Analysis, April 2026
• At-Bay — Cyber Insurance Claims Analysis, April 2026
• SonicWall — Cyber Protect Report, March 2026
• Spacelift — Small Business Cybersecurity Statistics 2026 (compilation citing Verizon, IBM, FBI, Hiscox, CrowdStrike, Sophos, KnowBe4)
• Kaspersky — Education Sector Ransomware Analysis, March 2026
• Quorum Cyber — 2026 Global Cyber Risk Outlook for Higher Education
• Bitsight — Q1 2026 CTI Observations

Last updated: May 2026. We update this page quarterly with the latest data from all primary sources.