Ransomware Costs Keep Climbing Even as Ransom Payments Drop Sharply, Global Report Finds

Sophos's seventh annual ransomware report reveals a paradox: organizations are paying attackers less but spending more to recover — and identity compromise has now overtaken exploited vulnerabilities as the primary attack vector.

Ransomware attackers are demanding and receiving less money than ever before — but that is not the full story. According to Sophos's The State of Ransomware 2026 report released Tuesday, July 21, the average cost to recover from an attack climbed 11% to $1.7 million even as median ransom payments fell 62%. The findings are drawn from 2,158 IT and cybersecurity leaders surveyed across 17 countries and represent the clearest picture yet of how the threat landscape is reshaping itself in real time.

The report lands at a pivotal moment for enterprise security teams. Defensive investments are working in some measurable ways — yet ransomware continues to exact a brutal toll on organizations, their finances, and the people tasked with defending them. For executives and board members navigating cybersecurity budgets, the data offers both encouragement and a sharp warning. If you're building your foundational understanding of this threat, our guide on how ransomware works and why it remains so damaging provides essential context for the trends explored here.

---

Ransom Payments Are Falling — But Recovery Costs Tell a Different Story

The Numbers Behind the Decline

The headline figures show meaningful progress on the payment side. The median ransom demand fell to $698,000 in 2026, down from $1.32 million in 2025 and $2 million in 2024 — a 65% decline over just two years. Median ransom payments followed a similar trajectory, dropping from $1 million in 2025 to $769,000 in 2026.

Negotiation is becoming a more common and effective tool. Fifty-one percent of organizations that paid a ransom successfully negotiated a discount off the original demand. The proportion of victims who paid at all dropped to 48%, while 66% recovered encrypted data using backups — a 12 percentage point jump from 2025. That shift toward backup-led recovery is one of the most encouraging signals in this year's data.

Why Recovery Costs Are Still Rising

Despite those gains, the financial pain of recovery is intensifying. Excluding ransom payments entirely, the average recovery cost rose to $1.7 million from $1.53 million the previous year. Downtime, device replacement, network restoration, and lost revenue remain the dominant cost drivers — expenses that no negotiated discount can offset.

This is the core paradox of the 2026 report. Organizations are getting better at resisting extortion, but the operational disruption caused by an attack has not diminished. Paying less to attackers does not translate directly into spending less overall. For boards and executives, this distinction is critical: ransomware budget conversations must be anchored in total recovery cost, not ransom payment exposure alone.

Editorial note: This gap between falling payments and rising recovery costs is arguably the most important insight in this year's data for C-suite decision-making. Organizations that benchmark their ransomware risk purely against median payment figures are substantially underestimating their true financial exposure.

---

Identity Is Now the Primary Entry Point for Ransomware Attacks

A Fundamental Shift in How Attackers Get In

For defenders, the most structurally significant finding in the 2026 report is a fundamental shift in how attackers gain initial access. After three consecutive years as the leading entry vector, exploited vulnerabilities dropped 14 percentage points to just 18% of incidents. Identity compromise has taken its place at the top.

Malicious email now accounts for 26% of ransomware root causes and phishing for 24% — meaning email-based attacks together represent half of all incidents. Sixty-seven percent of ransomware victims confirmed their attack was directly tied to their organization's most significant identity breach.

The MFA Problem Nobody Wants to Acknowledge

Perhaps most alarming for security teams is the MFA finding. In incidents where compromised credentials were the root cause, 97% of affected organizations had MFA deployed in some capacity. Attackers are exploiting gaps in partial rollouts and actively bypassing traditional MFA implementations through techniques including MFA fatigue attacks, SIM swapping, and adversary-in-the-middle phishing frameworks.

The presence of MFA alone is no longer a reliable control. Coverage, consistency, and the quality of implementation now determine whether MFA provides genuine protection or a false sense of security.

"Stolen credentials are now the dominant ransomware entry point and the trend is accelerating," said Shane Barney, CISO at Keeper Security. "Once attackers obtain a legitimate identity, they can move through an environment undetected, escalating privileges and staging ransomware before most teams know something is wrong."

Chandra Gnanasambandam, CTO at SailPoint, framed the scale of the challenge directly. "Attacks that once took a year to succeed now take about an hour," he said. "Cybercrime has industrialized, and with 95% of access still standing rather than granted just in time, identity is the obvious weak point."

Perimeter Defenses Still Provide Measurable Value

Perimeter defenses remain a meaningful layer of protection. Sixty-one percent of firewalls detected attacks before the ransomware payload deployed. When early detection failed, 71% of organizations suffered full data encryption — compared to 50% when the firewall caught the intrusion first. That 21 percentage point difference in encryption outcomes underscores why layered defense architectures continue to matter even as the identity layer demands greater investment.

James Maude, Field CTO at BeyondTrust, argued that the industry needs to redirect its focus. "Ransomware and other threats are only as effective as the privileges and access they manage to acquire," he said. "If we can implement better hygiene and focus on least privilege, threat actors are far less likely to ransomware us in the first place."

---

The Human Cost and the Uneven Burden Across Sectors

Security Teams Are Bearing an Unsustainable Toll

Ransomware is not only a financial and technical crisis. The stress placed on security professionals is approaching universality. Ninety-nine percent of organizations that had data encrypted reported lasting impacts on their IT and cybersecurity personnel — a figure that should prompt serious reflection from leadership teams about how they support the people on the front line.

• 41% of affected organizations reported heightened anxiety and stress among staff regarding future attacks
• 40% faced increased pressure from senior leadership following an incident
• 21% saw their entire IT and cybersecurity leadership team replaced as a direct consequence

These figures reflect a workforce under sustained, compounding pressure. Incident response is not a single event with a clean resolution — it creates organizational trauma that persists long after systems are restored. For smaller organizations with leaner security teams, the impact can be existential. Understanding how ransomware specifically threatens small and mid-sized businesses highlights why resource constraints make the human toll even more acute at that scale.

Sectoral Disparities Reveal Divergent Strategies

The burden is not distributed equally across sectors. Local and state government organizations paid ransoms at a rate of 72% — the highest of any sector — reflecting acute pressure to restore public services quickly and a structural vulnerability created by underfunded IT infrastructure. Media, leisure, and entertainment organizations paid in 64% of incidents.

Retail organizations stood out in the opposite direction: only 32% paid, demonstrating a greater willingness to rely on backups and absorb operational downtime. This divergence suggests that sectors with strong backup discipline and rehearsed recovery processes retain more leverage in the aftermath of an attack — and are less likely to face the binary choice between paying and prolonged outage.

The AI-Augmented Phishing Threat

Mika Aalto, Co-Founder and CEO at Hoxhunt, offered a clarifying analogy for the phishing surge driving many of these incidents. "If ransomware is the explosion, phishing is often the spark," he said. Aalto noted that AI-generated phishing surged 14-fold almost overnight at the turn of 2025 to 2026, with attackers modernizing existing tactics rather than inventing new ones. The implications for email security investment and behavioral training programs are significant — generic awareness training is no longer sufficient against attacks that are personalized, contextually convincing, and generated at scale.

---

What Organizations Should Do Now

Sophos recommends organizations prioritize Identity Threat Detection and Response, deploy advanced email filtering with DMARC and DKIM authentication protocols, integrate firewall telemetry with MDR or XDR tools, and maintain offline immutable backups tested regularly for reliable restoration.

For teams that have already experienced an incident or want to prepare structured response capabilities, a detailed guide on how to respond effectively to a ransomware attack outlines the steps organizations should have documented before they are needed. The Cybersecurity and Infrastructure Security Agency (CISA) also maintains a comprehensive ransomware resource hub with response guidance, alert advisories, and sector-specific recommendations.

The 2026 ransomware picture is one of hard-won but incomplete progress. Payments are down. Backup adoption is rising. But recovery costs are climbing, identity-based intrusions are accelerating, and the human toll on security teams is severe. Organizations that treat identity governance as a core security perimeter — not a secondary control — and invest in behavioral security culture rather than awareness training alone will be better positioned as AI-augmented threats continue to evolve.

---

How to Act on This Information

• Security leaders should audit privileged account access immediately and implement least-privilege principles as a baseline control rather than an aspirational goal
• Executives and board members should reframe ransomware budget conversations around total recovery costs — not just ransom payments — to accurately assess financial exposure
• IT teams should test backup restoration protocols now, before an incident, to confirm that recovery without paying a ransom is genuinely viable for their organization