Only 18% of organisations that suffered a ransomware attack paid the ransom, while 59% recovered from backups.

On average, organizations recover 72% of affected data following a ransomware attack.

Among organizations hit by ransomware where operations or data were affected, 44% recovered less than 75% of affected data.

Among organizations that paid ransoms, 61% successfully recovered their data, up from 54% the previous year.

Among organizations hit by ransomware where operations or data were affected, only 28% fully recovered all affected data.

Full data recovery is 40% among organizations reporting increased cybersecurity budgets versus 16% among organizations without increased budgets.

90% of restores are single-file downloads.

Only 29% of IT leaders expressed very high confidence in their ability to recover critical data after a zero-day exploit, while 59% were only somewhat confident.

74% of US-based IT and security professionals said their data recovery tools are too complex to be used without security expertise, which adds to their workplace stress.

Other insuring agreements (average) were triggered as the main driver of loss in 1.6% of claims, triggered with some loss impact in 1.4%, triggered with no loss impact known in 0.5%, and not triggered in 96.6%.

11% of senior IT decision-makers state it would take a month or more to recover data after a loss incident, or that they might not be able to fully recover at all.

41% of those who paid a ransom failed to recover all their data.

32% of ransomware victims paid the attackers to recover or restore data.

54% of ransom-paying victims recovered their data—down from 73% two years ago.

Most affected organizations could not recover all of their data after a ransomware attack.