Only 18% of organisations that suffered a ransomware attack paid the ransom, while 59% recovered from backups.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

69% of ransomware victims didn’t pay.

58% of cybersecurity leaders would consider paying cybercriminals to end a ransomware attack.

Victims were given an average of 7.7 days to meet ransom demands in Q1 2026.

The average ransom demand exceeded $1,028,214 in Q1 2026.

Akira ransom demands averaged $1.2M, which is 50% higher than the non-Akira average.

Among organizations that paid ransoms, 61% successfully recovered their data, up from 54% the previous year.

Among organizations victimized by ransomware, the share that paid a ransom increased from 41% to 55%.

Global traceable ransomware payments fell from $892 million in 2024 to $820 million in 2025.

Global ransomware payments reached $820 million in 2025.

62% of US IT and security professionals at companies with at least 1,000 employees believe AI makes it more likely their company will need to pay a ransom to regain access to its data after an attack.

Only 33% of cyber insurance policies cover lost revenue, and 45% cover ransomware negotiations or payment.

89% of organizations that experienced a ransomware attack in the past year paid a ransom to recover their data or stop the attack

58% of retail organizations with encrypted data paid the ransom in 2025, marking the second highest payment rate in five years

The amount of data most organizations got back after paying a ransom was 51–75%.

8% of organizations got all their data back after paying a ransom.

54% of organizations attacked paid a ransom.

Only 3% of undisclosed ransomware cases included an upfront ransom demand in Q3 2025.

92% of organizations still lost data after paying a ransom.