Before 2023, 62.8% of backups were affected by ransomware.

Before 2023, 37.2% of backups were not affected by ransomware.

In 2023, organizations took an average of 32 days to restore operations after a ransomware attack.

In 2023, only 11.1% of backups were affected by ransomware.

For data breach cases where the attacker was detected by internal IT staff or an outsourced cybersecurity provider (OCP), it took an average of 61 days to notice the attacker prior 2019.

The average duration business operations were affected by ransomware in professional services was 85 days.

Businesses typically required around two full months to restore operations following a ransomware attack.

37.2% of large losses came from other causes, 16.0% from data breaches, and 46.6% from ransomware. While other causes ticked up, ransomware continued to generate nearly half of the most expensive claims.

In 66.0% of data breach cases since 2019, the company’s own IT team or outsourced service providers discovered the attack.

Across all data breach cases combined, the average time to notice an attacker was 90 days prior 2019.

Business interruption was triggered as the main driver of loss in 17.5% of claims (primary 15.1%, excess 23.3%), triggered with some loss impact in 12.6%, triggered with no loss impact known in 7.3%, and not triggered in 62.6%.

In 2022, organizations took an average of 43 days to restore operations after a ransomware attack.

In 10.2% of large ransomware claims, the attack vector was either different or unknown.

Privacy & cyber security was triggered as the main driver of loss in 13.2% of claims (primary 9.4%, excess 22.2%), triggered with some loss impact in 14.6%, triggered with no loss impact known in 3.3%, and not triggered in 68.9%.

On average, businesses across all industries experienced 69 days of operational disruption due to ransomware attacks.

In 7.1% of cases prior to 2019, the hackers themselves revealed the breach.

In 10.6% of cases since 2019, the source of detection was unknown or other.

Across all data breach cases combined, the average time to notice an attacker was 45 days since 2019.

In 2020, organizations took an average of 54 days to restore operations after a ransomware attack.

For data breach cases where the attacker was detected by internal IT staff or an outsourced cybersecurity provider (OCP), it took an average of 35 days to notice the attacker since 2019.