56% encrypted
Over half of ransomware attacks succeeded in encrypting data, up from last year's report.
The state of ransomware 2026
How ransomware attacks start, what happens when they succeed, and what recovery really costs.
Read the seventh annual Sophos report for real-world insights from 2,158 IT and cybersecurity leaders across 17 countries.
Key findings
Headline statistics from 2,158 IT and cybersecurity leaders across 17 countries.
$769K median payment
The median ransom payment, down from $1 million in the 2025 report.
$1.7M recovery cost
The average cost to recover from an attack, excluding any ransom paid.
99% of teams affected
Victims with encrypted data said the attack affected their IT and cybersecurity team.
What you'll discover
The data tells a story of costly outcomes mixed with genuine progress. Highlights from this year's report:
50%
of attacks began with malicious email (26%) or phishing (24%), now the top root causes
$698K
median ransom demand, down from $1.3 million in the 2025 report
51%
of organizations that paid a ransom paid less than the amount demanded
66%
recovered encrypted data using backups, up from 54% in the 2025 report
New in 2026
New research in this report
For the first time, the report explores:
- 38%Where attacks start. Exposed apps and systems lead, ahead of user devices (30%) and firewalls (21%).
- 97%The role of MFA. Credential-based victims had MFA deployed in some capacity.
- 61%The role of firewalls. Victims whose firewall detected the attack before the payload was deployed.
- 67%Identity and ransomware. Victims whose ransomware incident was also their most significant identity attack.
How do your ransomware experiences compare?
2,158 professionals from 17 countries detail their real-world ransomware experiences in our seventh annual report.
Based on an independent, vendor-agnostic survey of organizations with 100 to 5,000 employees, the report covers attack and defense methods, data encryption and recovery, ransom demands and payments, and business and human impact. It includes:
- Seven-year attack trends
- Technical and operational root causes of attacks
- Current encryption and data theft success rates
- Ransomware demands vs. payments
- Recovery costs and time
- The impact of attacks on IT and cybersecurity teams
Topics covered in the report
Key areas explored in the State of Ransomware 2026.
Why organizations get hit
Which technical and operational factors leave organizations exposed and how they vary by company size.
What happens to the data
How the data encryption rate and data theft success rate have changed year over year.
Ransom negotiations
Why most ransom payments differ from the amount initially demanded.
The cost of ransomware
How recovery costs and recovery times have changed year over year.
Human impact
How a ransomware attack affects IT and cybersecurity teams, from stress to senior leadership pressure.
Defense strategies
Key recommendations to help you stay ahead of ransomware attacks.
Optimize your ransomware defense strategy
Download the report
Discover what's happening on the front line and use the insights to enhance your defenses.
Strengthen your ransomware defenses
Connect with our team to discuss how Sophos can help protect your organization.
Get expert guidance
Our team can help you assess your ransomware readiness and recommend the right combination of Sophos products to protect your organization.
- Free technical consultation
- Custom deployment planning
- Flexible licensing options
Related resources
Explore more threat intelligence and security solutions from Sophos.
Sophos Managed Detection and Response
24/7 threat hunting and incident response from Sophos experts to stop ransomware before damage occurs.
Discover Sophos MDR servicesSophos Identity Threat Detection and Response
Detect and respond to identity-based attacks, the leading path to ransomware in this year's report.
Explore Sophos ITDRAnti-ransomware toolkit
Educate your workforce and deploy best practices to reduce your ransomware risk.
Get the toolkit