17% of UK organisations hit by ransomware in the past year paid the ransom. This figure is down from 27% in 2024 and 44% in 2023.

UK organisations are now more than three times more likely to recover from backups than pay the ransom.

57% of UK organisations recovered from backups when hit by ransomware.

24% of UK organisations have a formal policy never to pay a ransom. This figure is double the figure from 2023

Data exfiltration was a factor in 74% of all ransomware cases in Q2 2025.

The industries hit hardest by ransomware in Q2 2025 were Professional services: 19.7%, Healthcare: 13.7%, and Consumer services: 13.7%.

Mid-sized companies (defined as 11 to 1,000 employees) constituted 64% of ransomware victims in Q2 2025.

The median ransom payment in Q2 2025 reached $400,000, which is a 100% increase from Q1 2025.

The top ransomware variants in Q2 2025 were: Akira (19%), Qilin (13%), and Lone Wolf (9%).

The overall rate of organizations paying ransoms in Q2 2025 held steady at 26%.

The average ransom payment in Q2 2025 rocketed to $1.13 million, marking a 104% increase from Q1 2025.

BabLock, another ransomware strain, had a prevention effectiveness rate of 34%.

BlackByte, a ransomware strain, had a prevention effectiveness rate of just 26%.

Maori, a ransomware strain, had a prevention effectiveness rate of 41%.

37% of organisations affected twice or more by ransomware paid the attackers.

Email is a primary attack vector for ransomware, with 71% of organisations that suffered an email breach also being hit with ransomware.

57% of the organisations surveyed were affected by ransomware.

29% of ransomware incidents involved infecting devices with other malicious payloads.

61% of repeat ransomware victims say their security tools do not integrate.

27% of ransomware incidents involved attackers publishing data.