Businesses typically required around two full months to restore operations following a ransomware attack.

37.2% of large losses came from other causes, 16.0% from data breaches, and 46.6% from ransomware. While other causes ticked up, ransomware continued to generate nearly half of the most expensive claims.

In 2022, organizations took an average of 43 days to restore operations after a ransomware attack.

In 49.2% of large ransomware claims, attackers gained access by exploiting system vulnerabilities.

In 10.2% of large ransomware claims, the attack vector was either different or unknown.

The average duration business operations were affected by ransomware in technology was 57 days.

In 2019, organizations took an average of 76 days to restore operations after a ransomware attack.

Between 2019 and 2023, professional services experienced large losses primarily from ransomware (75.0%), followed by data breaches (14.3%) and other causes (10.7%).

Average initial ransom demand (based on all cases with ransom demand) in 2019: $7.77 million.

2021: 29.7% of large losses came from other causes, 23.7% from data breaches, and 46.6% from ransomware. Ransomware overtook all other causes and drove nearly half of the biggest cyber claims.

Ransomware incidents often lead to significant business interruptions, with some level of systems shutdowns occurring in approximately 92% of these cases.

2019: 28.1% of large losses came from other causes, 29.2% from data breaches, and 45.1% from ransomware. Ransomware surged and became the leading cause of major cyber claims for the first time.

Between 2019 and 2023, other sectors experienced large losses primarily from ransomware (53.1%), followed by data breaches (25.0%) and other causes (21.9%).

On average, businesses across all industries experienced 69 days of operational disruption due to ransomware attacks.

In 2021, organizations took an average of 77 days to restore operations after a ransomware attack.

In 2023, victims paid on average 39.1% of the initial ransom demand.

Average initial ransom demand (based on all cases with ransom demand) in 2021: $17.39 million.

The average duration business operations were affected by ransomware in manufacturing was 62 days.

The average duration business operations were affected by ransomware in financial services was 33 days.

In 2020, organizations took an average of 54 days to restore operations after a ransomware attack.