Cybersecurity statistics / Recovery Costs

Average recovery cost is $1.7 million per incident, up 11% year-over-year.

Publisher	Sophos
Report	The State of Ransomware 2026
Published	15 July 2026
Topics	Recovery Costs, Economics

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

In 2025, 98% of organizations reported spending between $1 and $5 million to recover from cyber incidents, with the average recovery cost per incident being $2.5 million.

Absolute Security, 13/01/2026

Median ransom demand is $698,000, down 65% over two years.

Sophos, 18/07/2026

Across all ransomware attacks, 48% of ransom demands are for $1 million or more.

Sophos, 18/07/2026

Median ransom payment is $769,000, down from $1,000,000 the previous year.

Sophos, 18/07/2026

56% of ransomware attacks succeed in encrypting data, up from 50% the previous year.

Sophos, 18/07/2026

79% of ransomware attacks start with an identity-based approach.

Sophos, 18/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.