Top 20 Ransomware Statistics You Should Know (2025)

Ransomware in 2025 shows a broader, more entrenched threat landscape, with 44% of breaches analysed in Verizon’s 2025 DBIR executive summary involving ransomware, and 39% of breaches in larger organisations, while SMBs faced ransomware in 88% of breaches. The economics are shifting as more victims refuse to pay: the median ransom fell to $115,000, 64% of victim organisations did not pay, and IBM’s 2025 study reported 63% refused to pay (37% paid).

Even when payments occur, the cost of incidents remains high, with IBM noting an average extortion incident cost of $5.08 million and Sophos reporting US average insurance claims at $353,000, alongside a mean recovery cost excluding ransom payments of $1.53 million. Encryption is declining, with data encryption in 50% of attacks, and 28% of those involved data exfiltration, while 97% of encrypted data was recoverable by some method.

The threat surface is expanding, as 85 active extortion groups were listed in Q3 2025, Akira accounted for 34% of observed attacks, and Qilin for 10%, with the UK reporting only 1% of organisations having a ransomware incident but 7% of cybercrime respondents identifying ransomware as the attack type.