Skip to main content

Cybersecurity statistics / Ransomware

67% of ransomware victims confirmed their ransomware incident stemmed from an identity attack.

PublisherSophos
ReportThe State of Identity Security 2026
Published12 May 2026
TopicsRansomware, Identity Compromise

Published by Sophos in The State of Identity Security 2026, 12 May 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.
Comparitech, 19/07/2026
The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.
ReliaQuest, 19/07/2026
The Gentlemen posted 101 victims in April, 77 in May, and 122 in June.
ReliaQuest, 19/07/2026
Deadlock emerged in June 2026 with 75 named victims in a single month.
ReliaQuest, 19/07/2026
Deadlock was absent from public data-leak sites for 11 months before emerging publicly.
ReliaQuest, 19/07/2026
Qilin fell from 111 data leak posts in April to 79 in June, a 29% decrease.
ReliaQuest, 19/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.