{ "question": "How common is ransomware, and do victims pay?", "answer": "Ransomware was involved in 48% of the 22,625 confirmed data breaches in Verizon's 2026 Data Breach Investigations Report, which covers November 2024 to October 2025, up from 44% a year earlier. Fewer victims pay: 69% did not pay, and the median ransom paid fell to $139,875. In the US, the FBI received 3,611 ransomware complaints in 2025.", "period": "Nov 2024 to Oct 2025", "key_numbers": [ { "value": "48%", "label": "Data breaches that involved ransomware", "note": "Verizon DBIR 2026, up from 44%", "stat": "cybersecurity/breaches-involving-ransomware" }, { "value": "69%", "label": "Ransomware victims who did not pay", "note": "Verizon DBIR 2026, up from 65%", "stat": "cybersecurity/ransomware-victims-who-did-not-pay" }, { "value": "$139,875", "label": "Median ransom paid", "note": "Verizon DBIR 2026, down from $150,000" }, { "value": "96%", "label": "Ransomware victims that were small or mid-size", "note": "Verizon DBIR 2026, under 1,000 employees", "stat": "cybersecurity/ransomware-victims-that-are-smb" }, { "value": "39%", "label": "Breached organizations hit by ransomware", "note": "IBM / Ponemon, 2026 report, up from 24% in 2023", "stat": "cybersecurity/breached-organizations-hit-by-ransomware" }, { "value": "3,611", "label": "Ransomware complaints to the FBI", "note": "FBI IC3, 2025, $32.3M in reported losses", "stat": "cybersecurity/us-ransomware-complaints-2025" } ], "tables": [ { "id": "how-common", "title": "How common ransomware is, by measure", "columns": [ "Measure", "Latest", "Earlier", "Source" ], "rows": [ [ "Confirmed data breaches that involved ransomware", "48% (Nov 2024 to Oct 2025)", "44% a year earlier", "Verizon DBIR 2026" ], [ "Breaches in the System Intrusion pattern that involved ransomware", "77% (Nov 2024 to Oct 2025)", "Not reported", "Verizon DBIR 2026" ], [ "Breached organizations whose systems were hit by ransomware", "39% (2026 report)", "24% (2023 report)", "IBM / Ponemon" ], [ "Ransomware victims that were small or mid-size (under 1,000 staff), where size is known", "About 96% (Nov 2024 to Oct 2025)", "Not reported", "Verizon DBIR 2026" ], [ "UK businesses whose devices were targeted with ransomware in the last 12 months", "1% (2025/26)", "3% (2024/25 and 2023/24)", "UK Cyber Security Breaches Survey" ], [ "Ransomware complaints filed with the FBI", "3,611 (2025)", "3,156 (2024)", "FBI IC3" ] ], "row_ids": [ "share-breaches", "share-system-intrusion", "share-breached-orgs", "smb-share", "uk-businesses", "us-complaints" ], "note": "Each row has a different base: breaches, breached organizations, all UK businesses or complaints to the FBI. Do not compare the percentages as if they measured the same thing." }, { "id": "payments", "title": "Do ransomware victims pay?", "columns": [ "Measure", "Latest", "Year before", "Source" ], "rows": [ [ "Ransomware victims that did not pay", "69% (2025)", "65% (2024)", "Verizon DBIR 2026" ], [ "Median ransom paid, where a payment was made", "$139,875", "$150,000", "Verizon DBIR 2026" ], [ "Median share of publicized victims that paid, per ransomware group", "About 9%", "Not reported", "Verizon DBIR 2026" ], [ "UK businesses with a rule or policy not to pay", "49% (2025/26)", "52% (2024/25)", "UK Cyber Security Breaches Survey" ], [ "UK businesses with a breach or attack that paid a ransom", "2% (2025/26)", "Not checked", "UK Cyber Security Breaches Survey" ], [ "Ransomware losses reported to the FBI", "$32.3M (2025)", "$12.5M (2024)", "FBI IC3" ] ], "row_ids": [ "not-paid", "median-paid", "group-paid-share", "uk-no-pay-policy", "uk-paid-ransom", "us-losses" ], "note": "Verizon restated its earlier ransom medians after adding new data contributors, so the $150,000 for the year before differs from the 2025 DBIR. FBI losses leave out downtime, lost business and recovery costs, and many victims report no loss amount, so they are far below what ransomware really costs." }, { "id": "history", "title": "Ransomware complaints and reported losses to the FBI, 2019 to 2025", "columns": [ "Year", "Complaints", "Reported losses" ], "rows": [ [ "2019", "2,047", "$8.9M" ], [ "2020", "2,474", "$29.1M" ], [ "2021", "3,729", "$49.2M" ], [ "2022", "2,385", "$34.3M" ], [ "2023", "2,825", "$59.6M" ], [ "2024", "3,156", "$12.5M" ], [ "2025", "3,611", "$32.3M" ] ], "row_ids": [ "hist-2019", "hist-2020", "hist-2021", "hist-2022", "hist-2023", "hist-2024", "hist-2025" ], "note": "From each year's IC3 Internet Crime Report. Losses leave out downtime and recovery. The 2024 count is from the three-year complaint count table, which the 2025 report repeats.", "source": "fbi-ic3" } ], "sources": [ { "name": "Data Breach Investigations Report (DBIR)", "publisher": "Verizon Business", "type": "vendor", "url": "https://www.verizon.com/" }, { "name": "Cost of a Data Breach Report", "publisher": "IBM (research by Ponemon Institute)", "type": "vendor", "url": "https://www.ibm.com/" }, { "name": "Internet Crime Report (IC3 Annual Report)", "publisher": "FBI Internet Crime Complaint Center", "type": "official", "url": "https://www.ic3.gov/" }, { "name": "Cyber Security Breaches Survey", "publisher": "UK Department for Science, Innovation and Technology (DSIT)", "type": "official", "url": "https://www.gov.uk/" } ], "content_changed_on": "2026-10-30", "page_url": "https://digitaltreed.com/statistics/cybersecurity/ransomware-statistics", "csv_url": "https://digitaltreed.com/statistics/cybersecurity/ransomware-statistics.csv" }