Ransomware Statistics 2026: Attacks, Payments, Costs
Ransomware was involved in 48% of breaches in Verizon’s 2026 report, up from 44%, yet fewer victims are paying. On-chain ransomware payments fell 8% to about $820 million in 2025 even as claimed attacks rose 50%, and Chainalysis estimates only 28% of victims paid. The cost of recovering, though, keeps climbing: $1.7 million on average, before any ransom. Here are the ransomware statistics worth knowing in 2026, each sourced inline with the year noted.
Ransomware is in 48% of breaches
Ransomware was present in 48% of breaches, up from 44% the year before (Verizon, Data Breach Investigations Report executive summary, 2026).
69% of ransomware victims in Verizon’s dataset didn’t pay, and the median ransom paid fell to $139,875 from $150,000 (Verizon, 2026).
31% of all breaches now start with an exploited software vulnerability, overtaking stolen credentials as the top way in (Verizon, 2026).
Only 28% of victims paid in 2025
Ransomware actors received about $820 million in on-chain payments in 2025, down 8% from $892 million in 2024 (Chainalysis, 2026). Chainalysis expects the total to approach or pass $900 million as more payments are traced.
Claimed ransomware victims rose 50%, the most active year on record, so the share of victims who paid fell to an estimated 28%, potentially an all-time low (Chainalysis, 2026).
The median ransom payment rose 368%, from $12,738 in 2024 to $59,556 in 2025 (Chainalysis, 2026). Fewer victims paid, but those who did paid more.
Recovery costs $1.7 million, before the ransom
The average cost to recover from a ransomware attack, excluding any ransom, was $1,700,200, up 11% from $1,525,716 (Sophos, The State of Ransomware 2026, 2026). Sophos surveyed 2,158 IT and security leaders in 17 countries whose organizations were hit in the past year.
56% of attacks succeeded in encrypting data, including 16% where data was both encrypted and stolen (Sophos, 2026).
48% of organizations whose data was encrypted paid the ransom (Sophos, 2026).
The median ransom demand fell to $698,000, from $1.3 million in the 2025 report and $2 million in 2024, and the median payment fell to $769,000 from $1 million (Sophos, 2026).
51% of organizations that paid a ransom paid less than the amount demanded (Sophos, 2026).
Most ransomware now starts with email
Malicious email (26%) and phishing (24%) were the top two root causes of ransomware attacks, half of all incidents between them (Sophos, 2026).
Exploited vulnerabilities fell from 32% to 18% of ransomware root causes, after three years in first place. Compromised credentials held at 23% (Sophos, 2026).
79% of ransomware attacks started with an identity-based approach, stealing credentials or using ones already stolen (Sophos, 2026).
Multi-factor authentication was deployed in some form in 97% of incidents where compromised credentials were the root cause (Sophos, 2026). MFA on its own did not stop them.
The FBI received 3,611 ransomware complaints in 2025
The FBI’s Internet Crime Complaint Center received 3,611 ransomware complaints in 2025, up from 3,156 in 2024 and 2,825 in 2023 (FBI IC3, 2025 Internet Crime Report, 2026).
Reported ransomware losses were $32.3 million, up from $12.5 million in 2024 (FBI IC3, 2026). The FBI notes the figure usually leaves out lost business, time, wages and outside remediation, so it understates the real cost.
The FBI identified 63 new ransomware variants in 2025, about five a month. The most reported were Akira, Qilin, INC/Lynx/Sinobi, BianLian and Play (FBI IC3, 2026).
Among ransomware complaints outside critical infrastructure, legal services made up 18% and contracting services 17%, ahead of engineering and architecture firms at 10% (FBI IC3, 2026).
For breaches, fraud and phishing beyond ransomware, see cybersecurity statistics.
The inbox is where it starts
Half of ransomware now begins with an email, often one that looks routine, opened by someone with a full inbox and no time to look twice. Carly takes the routine load off that person, handling email triage, scheduling and follow-up, so the messages that deserve a slow, careful read get one. Carly connects to Gmail and Outlook through Google and Microsoft sign-in, and to thousands of other apps. For the volume side of the problem, see our email statistics.
FAQ
What percentage of breaches involve ransomware? 48% in Verizon’s 2026 Data Breach Investigations Report, up from 44% the year before (Verizon, 2026).
How many ransomware victims pay? Estimates range from about 28% of all victims (Chainalysis, 2026) to 48% of organizations whose data was encrypted (Sophos, 2026). In Verizon’s dataset, 69% didn’t pay (Verizon, 2026).
How much does a ransomware attack cost? The average recovery cost, not counting any ransom, was $1.7 million (Sophos, 2026).
How do ransomware attacks start? Most often by email. Malicious email (26%) and phishing (24%) were the top root causes in 2026 (Sophos, 2026).
Related: Cybersecurity Statistics · Deepfake Statistics · Email Statistics · Small Business Statistics · AI Agent Statistics
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
