By Aijaz Alam
How common is ransomware, and do victims pay?
Ransomware was involved in 48% of the 22,625 confirmed data breaches in Verizon's 2026 Data Breach Investigations Report, which covers November 2024 to October 2025, up from 44% a year earlier. Fewer victims pay: 69% did not pay, and the median ransom paid fell to $139,875. In the US, the FBI received 3,611 ransomware complaints in 2025.
- 48%Data breaches that involved ransomwareVerizon DBIR 2026, up from 44%
- 69%Ransomware victims who did not payVerizon DBIR 2026, up from 65%
- $139,875Median ransom paidVerizon DBIR 2026, down from $150,000
- 96%Ransomware victims that were small or mid-sizeVerizon DBIR 2026, under 1,000 employees
- 39%Breached organizations hit by ransomwareIBM / Ponemon, 2026 report, up from 24% in 2023
- 3,611Ransomware complaints to the FBIFBI IC3, 2025, $32.3M in reported losses
The numbers
The full breakdown
How common ransomware is, by measure
| Measure | Latest | Earlier | Source |
|---|---|---|---|
| Confirmed data breaches that involved ransomware | 48% (Nov 2024 to Oct 2025) | 44% a year earlier | Verizon DBIR 2026 |
| Breaches in the System Intrusion pattern that involved ransomware | 77% (Nov 2024 to Oct 2025) | Not reported | Verizon DBIR 2026 |
| Breached organizations whose systems were hit by ransomware | 39% (2026 report) | 24% (2023 report) | IBM / Ponemon |
| Ransomware victims that were small or mid-size (under 1,000 staff), where size is known | About 96% (Nov 2024 to Oct 2025) | Not reported | Verizon DBIR 2026 |
| UK businesses whose devices were targeted with ransomware in the last 12 months | 1% (2025/26) | 3% (2024/25 and 2023/24) | UK Cyber Security Breaches Survey |
| Ransomware complaints filed with the FBI | 3,611 (2025) | 3,156 (2024) | FBI IC3 |
Each row has a different base: breaches, breached organizations, all UK businesses or complaints to the FBI. Do not compare the percentages as if they measured the same thing.
Do ransomware victims pay?
| Measure | Latest | Year before | Source |
|---|---|---|---|
| Ransomware victims that did not pay | 69% (2025) | 65% (2024) | Verizon DBIR 2026 |
| Median ransom paid, where a payment was made | $139,875 | $150,000 | Verizon DBIR 2026 |
| Median share of publicized victims that paid, per ransomware group | About 9% | Not reported | Verizon DBIR 2026 |
| UK businesses with a rule or policy not to pay | 49% (2025/26) | 52% (2024/25) | UK Cyber Security Breaches Survey |
| UK businesses with a breach or attack that paid a ransom | 2% (2025/26) | Not checked | UK Cyber Security Breaches Survey |
| Ransomware losses reported to the FBI | $32.3M (2025) | $12.5M (2024) | FBI IC3 |
Verizon restated its earlier ransom medians after adding new data contributors, so the $150,000 for the year before differs from the 2025 DBIR. FBI losses leave out downtime, lost business and recovery costs, and many victims report no loss amount, so they are far below what ransomware really costs.
Over time
Ransomware complaints and reported losses to the FBI, 2019 to 2025
| Year | Complaints | Reported losses |
|---|---|---|
| 2019 | 2,047 | $8.9M |
| 2020 | 2,474 | $29.1M |
| 2021 | 3,729 | $49.2M |
| 2022 | 2,385 | $34.3M |
| 2023 | 2,825 | $59.6M |
| 2024 | 3,156 | $12.5M |
| 2025 | 3,611 | $32.3M |
From each year's IC3 Internet Crime Report. Losses leave out downtime and recovery. The 2024 count is from the three-year complaint count table, which the 2025 report repeats.
Why sources differ
Same question, different answers
| Number | When | Who measured | Why it differs |
|---|---|---|---|
| 48% | Nov 2024 to Oct 2025 | Verizon DBIR 2026 | Share of 22,625 confirmed breaches, from Verizon and partner case data |
| 39% | Mar 2025 to Feb 2026 | IBM / Ponemon | Share of 602 breached organizations interviewed |
| 1% | 2025/26 | UK Cyber Security Breaches Survey | Share of all UK businesses, breached or not, in the last 12 months |
| 3,611 | 2025 | FBI IC3 | Complaints filed by US victims; a count, not a share |
Ransomware figures range from 1% to 48% because each one divides by something different. Verizon's 48% is a share of confirmed breaches in its case data: organizations that were breached, found out, and reported it or had it reported. Verizon itself says this is not the chance that your organization will be hit. IBM's 39% is a share of the 602 breached organizations it interviewed, with breaches of a few thousand to about 115,000 records. The UK government survey asks a random sample of all businesses, most of them micro firms that were never breached, so only 1% say ransomware targeted their devices. The FBI's 3,611 is a count of complaints, and the FBI has said many victims never report. On payments, Verizon's 69% who did not pay and its $139,875 median come from case data supplied by its contributors, including firms that negotiate and handle ransom payments, not from a survey. Quote the measure with its base: "48% of breaches", not "48% of companies".
What it means
How to use these numbers
Ransomware is now in almost half of the breaches Verizon studies, but it pays criminals less than it did. Most victims (69%) refused to pay, and the median payment fell to $139,875. Verizon says the rise in refusals also happened in attacks that encrypted data, not only in those that stole it.
For a small business, the line to read is the 96%. Where Verizon knows the victim's size, nearly all ransomware victims had fewer than 1,000 employees. Attackers are mostly opportunistic: they get in with stolen passwords or unpatched devices and try anyone they can reach. Multi-factor login, prompt patching of internet-facing devices and offline backups are the basics.
Attackers are also changing tactics. In IBM's 2026 report, 41% of breached organizations hit by ransomware said the attackers threatened their reputation, with public shaming or leaks to the media, so a backup alone no longer ends the threat.
For journalists, the FBI's $32.3 million is not the cost of ransomware in the US. It is only the loss that complainants put a number on, without downtime or recovery.
Method and sources
How it was measured
Method
- Publisher
- Verizon Business: 2026 Data Breach Investigations Report (DBIR)
- Sample
- 31,861 incidents, of which 22,625 were confirmed breaches, in 145 countries, 1 November 2024 to 31 October 2025, from Verizon's own cases and partner contributors. Not a random sample.
- Definition
- A breach involves ransomware when a ransomware action appears anywhere in the attack chain. Payment figures come from DBIR data contributors, including firms that handle ransom payments, negotiations and crypto wallet tracking.
- Released
- 19 May 2026
- Checked at source
- 31 October 2026, in the 2026 DBIR PDF on verizon.com
- Next release
- The 2027 DBIR, expected spring 2027
- Last changed
- 30 Oct 2026
- Data files
- CSV · JSON (stable links)
Sources
- Data Breach Investigations Report (DBIR), Verizon Business Vendor data
- Cost of a Data Breach Report, IBM (research by Ponemon Institute) Vendor data
- Internet Crime Report (IC3 Annual Report), FBI Internet Crime Complaint Center Official data
- Cyber Security Breaches Survey, UK Department for Science, Innovation and Technology (DSIT) Official data
Cite this page
APA
MLA
HTML link
FAQ
More questions people ask
What share of ransomware victims pay the ransom?
In Verizon's 2026 DBIR, 69% of ransomware victims did not pay, up from 65% a year earlier. Across ransomware groups, the median share of publicly named victims that paid was about 9%.
How much is the average ransomware payment?
Verizon reports a median, not an average: $139,875 among victims that paid, in data from November 2024 to October 2025. A year earlier it was $150,000.
Are small businesses targeted by ransomware?
Yes. Where Verizon knew the victim's size, about 96% of ransomware victims had fewer than 1,000 employees. Verizon says many of these attacks are opportunistic: victims are hit because they had compromised passwords or unpatched edge devices, not because of their size.
Why do FBI ransomware losses look so small?
The FBI's $32.3 million for 2025 counts only what complainants reported losing. It leaves out downtime, lost business and recovery, and many victims report no amount or do not report at all.
Every number on this page was checked at its original source (Verizon Business, IBM (research by Ponemon Institute), FBI Internet Crime Complaint Center, UK Department for Science, Innovation and Technology (DSIT)). Free to cite with a link to this page.