Ransomware Statistics (2026): 40 Sourced Figures

This page collects figures on ransomware attacks, ransom payments and the cost of recovery. Every number links to the document that first published it. Two sources are official. They are the FBI Internet Crime Complaint Center (IC3) and the UK government’s Cyber Security Breaches Survey. The other four come from named research publishers that sell security products or services. Their figures are labeled as vendor-reported, with the size of each sample where the publisher states it. Organizations that plan for recovery after an attack can compare backup products on the StatWharf page for server backup software.

Method

The data window runs from 2023 to the second quarter of 2026. Most figures describe calendar year 2025 or surveys fielded in early 2026. StatWharf used primary sources only. That means government agencies and the original publisher of each report. Statistics aggregators and blogs that re-quote other sources were excluded. Each figure was checked against its source in October 2026. StatWharf dropped each figure that did not appear on its primary source. No value on this page is modeled, estimated or calculated by StatWharf.

The sources measure different things. The FBI counts complaints that victims file with it. Chainalysis traces payments on public blockchains. Sophos surveys IT leaders. Verizon analyzes incident and breach cases from its own work and from partners. Coveware reports on the cases it handles. The UK survey samples businesses across the country. Numbers from different sources are not directly comparable. A median ransom from one source does not confirm or contradict a median from another, because each describes a different group of victims.

How many ransomware attacks are reported

No public body counts every ransomware attack. The FBI publishes the number of complaints that victims file with IC3. The FBI states in the same report that these complaints represent only a small part of all ransomware activity. Chainalysis cites eCrime.ch data on victims that ransomware groups claim publicly. The UK survey reports the share of businesses that say they were hit.

IC3 complaints rose in each of the last two years. The 2025 total of 3,611 compares with 2,825 in 2023. The FBI names the ten variants reported most often in 2025. Akira is first, followed by Qilin, INC/Lynx/Sinobi, BianLian and Play. The FBI says these ten variants most affected three critical sectors: critical manufacturing, healthcare and public health, and government facilities.

Small professional firms appear often in the complaints. Outside the critical sectors, legal services account for the largest share. Contracting services and engineering firms follow. The UK picture is different. The share of UK businesses that reported a ransomware attack fell to 1% in 2025/2026, from 3% in each of the two previous years. The UK survey still extrapolates that about 9,000 businesses experienced ransomware as a cyber crime in the year.

Ransomware in data breaches

The Verizon Data Breach Investigations Report (DBIR) classifies breach cases by type. The 2026 edition covers more than 31,000 incidents. More than 22,000 of them were confirmed data breaches in 145 countries. The incidents took place between November 1, 2024 and October 31, 2025. Sophos reports how often attacks reached the encryption stage in its survey.

The Verizon summary describes small organizations as disproportionately affected by ransomware. The Sophos survey covered 2,158 IT and cybersecurity leaders in 17 countries. All of them worked at organizations with 100 to 5,000 employees. Sophos reports that 41% of attacks were stopped before encryption.

How ransomware attacks start

Sophos asks victims to name the root cause of their attack. In the 2026 edition, email-based methods moved to the top. Exploited vulnerabilities were the leading cause in the three previous editions.

Taken together, malicious email and phishing account for half of the root causes in the Sophos data. Exploited vulnerabilities dropped 14 percentage points from the previous edition. The FBI recommendations in its 2025 report start with backups. They then cover default passwords, multi-factor authentication, network segmentation and timely patching.

Ransom demands and payments

Payment data comes from three kinds of source. Chainalysis traces payments to known ransomware wallets. Sophos and Verizon report on victims in their datasets. Coveware reports on the cases it handles as an incident response firm. Coveware does not state a sample size in its quarterly post.

Total payments fell about 8% in 2025, by the Chainalysis count. Chainalysis expects its 2025 total to approach or exceed US$900 million as it attributes more payments. Its median payment rose from US$12,738 in 2024 to US$59,556 in 2025. Fewer victims paid, but the typical payment was larger.

The Sophos payment median comes from the 530 organizations that paid and shared the amount. The demand median comes from all organizations whose data was encrypted. The two medians therefore describe different groups. Sophos also reports that 51% of payers paid less than the amount first demanded. Coveware’s average and median moved in opposite directions in Q2 2026. Coveware attributes the gap to a small number of very large payments in data theft cases. The UK share of businesses with a no-payment rule was 52% in the previous edition.

Recovery cost, losses and backups

The cost of an attack goes well beyond any ransom. Sophos asks for the full cost to put things right, including downtime, staff time, devices, network costs and lost opportunity. The FBI loss figures cover only what victims reported to IC3.

The Sophos average recovery cost rose 11% from US$1,525,716 in the previous report. It remains below the US$2,730,684 peak in the 2024 report. The average sits far above the median of US$375,000, because a few very costly incidents raise it. Sophos found that 20% of organizations paid between US$500,000 and US$1 million to recover. Another 19% paid between US$1 million and US$5 million.

The IC3 loss figures are much lower than the payment totals from Chainalysis. The FBI explains why. Its ransomware loss figure does not normally include lost business, time, wages, files, equipment or third-party remediation. Some victims report no loss amount at all. The FBI calls the result an artificially low loss rate.

Backups are the most common way back. In the Sophos data, 66% of organizations with encrypted data used backups to recover it. Only 2% got no data back at all. The FBI’s first recommendation is to keep off-site or offline backups that are encrypted, immutable and cover all of the organization’s data.

What the figures show

Three points stand out. First, reported attacks keep rising while payments fall. IC3 complaints rose from 2,825 in 2023 to 3,611 in 2025. Leak-site claims grew 50% in 2025. Yet only 28% of ransoms were paid in the Chainalysis data, and 69% of victims in the Verizon dataset did not pay.

Second, recovery costs more than the ransom for many victims. The Sophos average recovery cost of US$1,700,200 excludes any ransom. It covers downtime, people time and lost opportunity. Organizations that refuse to pay still carry this cost.

Third, backups decide how fast an organization gets its data back. Backup-based recovery rose from 54% to 66% of encrypted cases in one year. The FBI lists immutable, offline backups as its first protective step. A business that builds a case for ransomware readiness can ask three questions about any figure here. Who was counted? Which period does it cover? Does it include the ransom, the recovery or both?

Where to go next

Organizations reviewing their recovery plan can compare products on the server backup software comparison. It sets out licensing, published pricing and recovery features for each product. It does not name a single best product. More sourced statistics pages are listed in the StatWharf research directory.

The next update follows three releases: Coveware’s third quarter 2026 report, the next Chainalysis ransomware update and the FBI IC3 report for 2026. Corrections to any figure can be sent to the editorial address below.

Factual corrections are free: editorial@statwharf.com.