Ransomware is now the default outcome of a serious breach. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of confirmed breaches, and about 96% of ransomware victims were small organisations. Sophos puts the average recovery cost, excluding any ransom, at $1.7 million. This guide collects the 2026 numbers that matter and turns them into a defence plan a small company can actually run.
Ransomware in 2026: the core numbers
Three large datasets were published in 2026 and they broadly agree. Verizon's DBIR, released on 19 May 2026, analysed more than 31,000 incidents and 22,000 confirmed breaches across 145 countries. Sophos surveyed 2,158 IT and security leaders in 17 countries whose organisations had been hit. IBM's Cost of a Data Breach study found that 39% of organisations it studied were hit by ransomware, the fourth straight annual increase.
The FBI's Internet Crime Complaint Center adds the victim reporting view: 3,611 ransomware complaints in 2025 with more than $32 million in reported losses. The FBI notes that this excludes downtime and other indirect costs, which is why it looks small next to survey-based recovery costs.
| Measure | Figure | Source |
|---|---|---|
| Breaches involving ransomware | 48% (44% a year earlier) | Verizon DBIR 2026 |
| Victims that did not pay | 69% | Verizon DBIR 2026 |
| Median ransom payment | $139,875 | Verizon DBIR 2026 |
| Attacks where data was encrypted | 56% | Sophos 2026 |
| Average recovery cost excluding ransom | $1.7 million | Sophos 2026 |
| Ransomware complaints to the FBI, 2025 | 3,611 | FBI IC3 |
Why small companies are hit hardest
Small organisations made up about 96% of ransomware victims in the 2026 DBIR data. Attackers are opportunistic: they scan for weak points and use whatever credentials they can buy. The DBIR found that small organisations had a median of seven credential leak events a year, and that among ransomware victims with a prior credential leak, half were hit within 95 days of that leak.
Small companies are also less likely to stop an attack in time. Sophos found that only 34% of organisations with 100 to 250 employees stopped attacks before encryption or extortion, compared with 46% of organisations with 3,001 to 5,000 employees. The gap is usually about monitoring and response capacity, not about knowing what to do.
How ransomware gets in
Sophos asked victims for the root cause of their attack. Malicious email and phishing together accounted for half of incidents, compromised credentials for 23%, and exploited vulnerabilities for 18%, down 14 percentage points on the year before. Sophos also reported that 79% of ransomware attacks started with an identity-based approach.
Verizon's data gives more weight to software flaws: exploited vulnerabilities were the top known initial access vector at 31% of breaches, and only 26% of critical vulnerabilities in the US government's Known Exploited Vulnerabilities catalogue were fully fixed by the organisations studied, with a median of 43 days to patch. The practical reading is that both email and patching need attention.
| Root cause (Sophos 2026) | Share of attacks |
|---|---|
| Malicious email | 26% |
| Phishing | 24% |
| Compromised credentials | 23% |
| Exploited vulnerabilities | 18% |
| Brute-force attacks | 6% |
To pay or not to pay
Fewer victims are paying. The DBIR found that 69% of ransomware victims did not pay, up from 65%, and the median payment fell to $139,875 from $150,000. Sophos found that 48% of victims whose data was encrypted paid, and 51% of those who paid negotiated the amount down. Its median demand was $698,000, 65% lower than two years earlier, while the median among victims who paid was $769,000.
Paying does not end the incident. Data may already be stolen, systems still need rebuilding, and the attacker knows you pay. Having backups that work is what makes refusing possible: the Cyber Readiness Institute's summary of the DBIR notes that 69% of small businesses that refused to pay did so because they had reliable backups.
Recovery: backups, time and cost
Backups are doing more of the work. Sophos found that 66% of victims with encrypted data restored from backup, up 12 percentage points from 2025. Over half of victims were running again within a week, and average recovery took roughly three weeks. In more than one in five cases the leadership team was replaced after the attack.
The money goes on rebuilding, investigation, lost trading and legal work. Sophos put the average recovery cost at $1.7 million excluding ransom, up 11% on the year, with close to one in five organisations spending $500,000 to $1 million. For a small company, even a fraction of that can be fatal, which is why prevention and fast restoration matter more than insurance alone.
Which groups are active
The FBI identified 63 new ransomware variants in 2025. The ten most reported variants accounted for 56.8% of incidents reported to IC3, and included Akira, Qilin, INC, Lynx and Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa. Critical manufacturing, healthcare and public health, and government facilities remained frequent targets.
Names change quickly as groups rebrand, split or shut down, so do not build defences around a specific variant or rely on a blocklist of group names. Most of them use the same entry points: stolen passwords, unpatched edge devices and phishing. Blocking those blocks most groups.
What small companies should do
Start with identity, because most attacks start there. Use phishing-resistant multi-factor authentication such as passkeys or security keys on email, remote access and admin accounts; Sophos found that 97% of victims whose root cause was compromised credentials had some form of MFA, which shows that weak MFA is not enough. Then fix internet-facing software on a short cycle and keep backups that an attacker cannot reach.
Write a one-page incident plan before you need it: who decides, who to call, how to isolate machines, and where the offline backup lives. Test a restore every quarter. XDQ Labs helps small teams set up and verify these controls on systems they own, but most of this list can be done in-house in a few weeks.
- Phishing-resistant MFA on email, VPN, cloud and admin accounts
- Patch internet-facing systems and known exploited vulnerabilities first
- Offline or immutable backups, with a restore test each quarter
- Monitor for leaked staff credentials and reset them quickly
- Endpoint detection and response on every laptop and server
- Remove unused remote access tools and old accounts
- A written incident plan with contacts for your bank, insurer and legal adviser
Frequently asked questions
What percentage of breaches involve ransomware in 2026?
Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of confirmed breaches, up from 44% the year before. IBM's 2026 study separately found that 39% of the organisations it studied had been hit by ransomware, the fourth annual increase in a row.
Are small businesses targeted by ransomware?
Yes. About 96% of ransomware victims in the 2026 DBIR data were small organisations. Sophos found that only 34% of organisations with 100 to 250 employees stopped attacks before encryption or extortion, compared with 46% of much larger organisations, mainly because of limited monitoring and response capacity.
How much is the average ransom payment?
The 2026 DBIR put the median ransom payment at $139,875, down from $150,000, and found 69% of victims did not pay. Sophos reported a median payment of $769,000 among those who paid, and an average recovery cost of $1.7 million excluding any ransom.
What is the best defence against ransomware for a small company?
Focus on the common entry points: phishing-resistant MFA on email and remote access, fast patching of internet-facing systems, and offline backups you have tested. Add endpoint detection on all devices and a written incident plan. Sophos found two thirds of encrypted victims now recover from backup, which makes refusing to pay realistic.
Sources
- Verizon Data Breach Investigations Report 2026, CyberScoop, 2026
- Verizon DBIR 2026: vulnerability exploitation, third-party risk and compliance, ComplianceHub, 2026
- 2026 Verizon DBIR reveals new attack vectors and 8 ways organizations can protect themselves, Secureframe, 2026
- 2026 Verizon Cyber Report: small businesses face escalating cyber threats, Cyber Readiness Institute, 2026
- Sophos State of Ransomware 2026, Sophos, 2026
- Ransom demands are down, email is the top way attackers get in, Help Net Security, 2026
- FBI IC3 2025 Internet Crime Report: 10 takeaways, SOCRadar, 2026
- FBI: cybercrime losses neared $21 billion in 2025, SecurityWeek, 2026
- Ten takeaways from IBM's 2026 Cost of a Data Breach Report, Baker Donelson, 2026
