There were a total of 393 attacks globally in May. This marks the third consecutive month in which ransomware attacks have dropped.

The median ransom payment was $1 million.

In 71% of cases where companies paid a smaller ransom than the initial demand, negotiation played a role, either directly or with third-party assistance.

35% of respondents cited ransomware as a top concerning threat.

The median ransom payment dropped by 50% from $2 million in 2024 to $1 million in 2025.

Organisations with $250 million revenue or less saw median ransom demands of less than $350,000.

Only 54% of companies used backups to restore their data after a ransomware attack, which is the lowest percentage in six years.

Lack of expertise was the top operational cause of ransomware attacks in organisations with over 3,000 people.

The average cost of recovery from a ransomware attack dropped from $2.73 million in 2024 to $1.53 million in 2025.

40% of ransomware victims stated that adversaries exploited a security gap they were unaware of, highlighting issues with attack surface visibility.

53% of companies that paid the ransom successfully negotiated a lower amount than the initial demand.

Lack of people/capacity was most frequently cited factor for falling for a ransomware attack by those with 251-500 employees.

Over half (53%) of organisations fully recovered from a ransomware attack in a week, up from 35% last year.

The median ransom demand decreased by a third between 2024 and 2025.

Data encryption was at a six-year low, with only half of companies having their data encrypted in a ransomware attack.

35% of respondents cited ransomware as a top concerning threat.

Overall, 63% of organisations cited resourcing issues as a contributing factor to falling victim to a ransomwre attack.

44% of companies were able to stop the ransomware attack before data was encrypted, marking a six-year high.

Nearly 50% of companies paid a ransom to recover their data, which is the second highest rate of ransom payment for demands in six years.

For the third year in a row, exploited vulnerabilities were identified as the number one technical root cause of ransomware attacks.