In 49.2% of large ransomware claims, attackers gained access by exploiting system vulnerabilities.

In 2020, organizations took an average of 54 days to restore operations after a ransomware attack.

Ransomware incidents often lead to significant business interruptions, with some level of systems shutdowns occurring in approximately 92% of these cases.

2020: 27.3% of large losses came from other causes, 29.2% from data breaches, and 43.4% from ransomware. Ransomware remained a dominant source of costly claims.

Between 2019 and 2023, professional services experienced large losses primarily from ransomware (75.0%), followed by data breaches (14.3%) and other causes (10.7%).

In 2019, organizations took an average of 76 days to restore operations after a ransomware attack.

In 10.2% of large ransomware claims, the attack vector was either different or unknown.

Before 2023, 37.2% of backups were not affected by ransomware.

Between 2019 and 2023, other sectors experienced large losses primarily from ransomware (53.1%), followed by data breaches (25.0%) and other causes (21.9%).

The average duration business operations were affected by ransomware in health care was 70 days.

Ransomware claims accounted for 54.3% of cyber claims in the sample for the period of 2019 and onwards.

On average, businesses across all industries experienced 69 days of operational disruption due to ransomware attacks.

The average cost of an individual ransomware attack rose by 17% in the first half of 2025.

The average duration business operations were affected by ransomware in professional services was 85 days.

In 2021, organizations took an average of 77 days to restore operations after a ransomware attack.

Businesses typically required around two full months to restore operations following a ransomware attack.

2021: 29.7% of large losses came from other causes, 23.7% from data breaches, and 46.6% from ransomware. Ransomware overtook all other causes and drove nearly half of the biggest cyber claims.

The average duration business operations were affected by ransomware in other industries was 44 days.

Between 2019 and 2023, healthcare experienced large losses primarily from ransomware (57.1%), followed by data breaches (28.6%) and other causes (14.3%).

2010–2017: 62.3% of large cyber losses came from other causes, 37.7% came from data breaches, and ransomware caused 0.0% of major losses. At this stage, ransomware claims were rare, and most large claims stemmed from breaches and miscellaneous incidents.