Skip to main content

Cybersecurity statistics / Ransom Demands

When ransomware attacks start with exploitation of a vulnerability in the firewall, 59% of those ransom demands are for $1 million or more.

PublisherSophos
ReportThe State of Ransomware 2026
Published15 July 2026
TopicsRansom Demands, Firewalls

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Median ransom demand is $698,000, down 65% over two years.
Sophos, 18/07/2026
Across all ransomware attacks, 48% of ransom demands are for $1 million or more.
Sophos, 18/07/2026
The UK records the highest median ransom demand for any country at $2.5 million.
Sophos, 18/07/2026
Across those attacks, 21% of initial compromises occur in firewalls.
Sophos, 18/07/2026
35% of healthcare practices that partner with an MSSP report better access to next-generation firewalls.
Omega Systems, 28/06/2026
58% of SMBs have firewalls.
VikingCloud, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.