Cybersecurity statistics / Ransom Demands

Across all ransomware attacks, 48% of ransom demands are for $1 million or more.

Publisher	Sophos
Report	The State of Ransomware 2026
Published	15 July 2026
Topics	Ransom Demands, Economics

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Median ransom demand is $698,000, down 65% over two years.

Sophos, 18/07/2026

The UK records the highest median ransom demand for any country at $2.5 million.

Sophos, 18/07/2026

When ransomware attacks start with exploitation of a vulnerability in the firewall, 59% of those ransom demands are for $1 million or more.

Sophos, 18/07/2026

Median ransom payment is $769,000, down from $1,000,000 the previous year.

Sophos, 18/07/2026

Average recovery cost is $1.7 million per incident, up 11% year-over-year.

Sophos, 18/07/2026

56% of ransomware attacks succeed in encrypting data, up from 50% the previous year.

Sophos, 18/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.