Across those attacks, 3% of initial compromises occur in IoT devices.

Publisher	Sophos
Report	The State of Ransomware 2026
Published	15 July 2026
Topics	IoT, Ransomware

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

54% of restaurants have between 26 and 99 connected IoT devices per location.

VikingCloud, 12/07/2026

Connected IoT device counts in manufacturing facilities are projected to more than double between 2025 and 2030.

Resilience, 27/05/2026

11 device types appear on the riskiest devices list for the first time: Serial-to-IP Converters and Workstations (IT) Printers, Time Clocks, and RFID Readers (IoT) Power Distribution Units (PDUs), I/O Modules, and BACnet Routers (OT) Medication Dispensing Systems, Medical Image Printers, and DICOM Gateways (IoMT)

Forescout, 27/05/2026

Roughly 40% of blocked IoT transactions are linked to the Mirai malware family.

ZScaler, 09/11/2025

Manufacturing and Transportation sectors accounted for over 40% of total IoT malware attacks, with each sector representing 20.2% of all observed attacks.

ZScaler, 09/11/2025

The United States accounted for 54% of all IoT attack activity.

ZScaler, 09/11/2025

Get the newsletter

Weekly cybersecurity statistics by email.