Ransomware Statistics for 2026: Attacks, Payments, Costs, and Their Limits

Picture a risk memo due Friday with one line on it: "Ransomware: how many attacks, how much is paid, what does it cost?" You need a figure for each, and each figure needs a source you can name in a meeting. This article gives you those figures, and it marks the places where the published numbers disagree or cannot be compared.

The most-cited ransomware statistics measure different things. Leak-site victim counts, FBI complaints, on-chain payments, incident-response casework and forecasts are all real, and each answers a different question. The block below gives the most useful figure for each question, with its population, period and source attached.

Key ransomware statistics for 2026

Attack volume

• 2,139 ransomware victims were posted on leak sites in Q2 2026, up 33% year over year and essentially flat on Q1 (+0.8%). Population: victims tracked by Check Point Research. Evidence type: leak-site observation. Source: Check Point Research, published 13 August 2026.

• Claimed ransomware victims rose 50% in 2025, the most active year on record. Population: claimed victims in eCrime.ch leak-site data. Evidence type: third-party dataset, reported secondhand by Chainalysis in its 2026 Crypto Crime Report, 26 February 2026.

• 7,366 victims were listed on leak sites between April 2025 and March 2026, a 3% decline year over year. Population: postings tracked by Zscaler ThreatLabz. Evidence type: vendor telemetry. Source: Zscaler press release, 30 September 2026.

• 3,611 ransomware complaints reached the FBI's Internet Crime Complaint Center (IC3) in calendar 2025, with $32.3 million in reported losses. Evidence type: victim-reported complaints, a floor on both counts. Reported by HIPAA Journal and CyberScoop, April 2026.

• Ransomware was present in 44% of breaches analysed in Verizon's 2025 Data Breach Investigations Report, and ransomware attacks rose 37%. Population: 22,000-plus incidents, including 12,195 confirmed breaches. Period: the year before the report, not 2026. Source: Verizon, 23 April 2025.

Payments

• More than $820 million in ransomware payments moved on-chain in calendar 2025, an 8% decline from an updated $892 million for 2024. Evidence type: blockchain measurement, which Chainalysis expects to revise toward or above $900 million. Source: Chainalysis, 26 February 2026.

• $59,556 median ransom payment in 2025, up 368% from $12,738 in 2024, per Chainalysis's blockchain analysis.

• $1,880,612 average ransom payment in Q2 2026, up 176% quarter over quarter, while the median fell 50% to $150,000. Population: Coveware incident-response cases. Evidence type: casework. Source: Coveware by Veeam, 29 July 2026. Quote the two together.

• $769,000 median ransom payment, from the Sophos survey described below. Source: Sophos State of Ransomware 2026.

• 85% of victims paid a ransom in Q1 2019; 37% paid in Q4 2022. On an annual basis, 76% paid in 2019 and 41% in 2022. Population: Coveware incident-response cases. The 2019 figures are historical. Source: Coveware, January 2023.

• Ransoms paid "potentially" reached an all-time low of 28% in 2025. Evidence type: Chainalysis estimate. "Potentially" is the source's word.

Encryption and cost

• 56% of ransomware attacks succeeded in encrypting data. Population: 2,158 IT and cybersecurity leaders in 17 countries, at organisations of 100 to 5,000 employees, covering the previous 12 months, fielded January to March 2026. Evidence type: self-reported survey. Source: Sophos.

• $74 billion in global ransomware damage in 2026 is a forecast, not a measurement. Cybersecurity Ventures built it from its own model, with a definition that includes downtime, lost productivity, legal costs and regulatory fines. Source: Cybersecurity Ventures, 4 February 2026.

Get the Mobile Testing Playbook Used by 800+ QA Teams

Discover 50+ battle-tested strategies to catch critical bugs before production and ship 5-star apps faster.

Email addressGet Instant Access

100% Free. No spam. Unsubscribe anytime.

How many ransomware attacks are there?

No source gives a reliable total of ransomware attacks, and the three most-used datasets do not agree on direction. Each counts a different thing over a different window.

Check Point and eCrime.ch record increases, while Zscaler records a small decline over a 12-month window that overlaps most of 2025. None of the three publishes a reconciliation with the others or a de-duplication method that would let you combine them. The disagreement tells you the leak-site population is measured inconsistently. It does not tell you whether attacks went up or down.

Check Point also reports that active ransomware groups reached 93 in Q2 2026, up from 71 in Q1, a new high for the period it tracks, while the top 10 groups' share of victims fell from 71% to 57.6%. That is a wider tail inside a still-concentrated population.

Group rankings differ by source too. Zscaler says Qilin, Akira and INC Ransom accounted for 34% of disclosed victims between April 2025 and March 2026. Coveware's Q2 2026 casework ranks Lone Wolf first at 17%, then ShinyHunters at 12% and Akira at 9%. Three populations produce three rankings, and the gap between them is itself a finding.

How much do ransomware victims pay?

The on-chain total and the case-level averages answer different questions, so keep them apart.

Chainalysis measures payments that reached identifiable wallets. Its 2025 total of more than $820 million is an estimate that the company expects to rise "as we attribute more events and payments". Its 2024 figure did exactly that, growing from an initial $813 million to $892 million. Quote the 2025 total with its date and its revision note.

Averages and medians tell different stories. Coveware's Q2 2026 casework shows an average of $1,880,612, up 176% in one quarter, while the median fell 50% to $150,000. Coveware attributes the gap to a few outsized data-exfiltration payments. An average alone would hide that shape.

Sophos's survey gives a median ransom of $769,000 and an average recovery cost of $1.7 million for organisations of 100 to 5,000 employees. The report page does not say whether the recovery cost includes the ransom itself. That population differs from Coveware's incident-response caseload and from Chainalysis's on-chain data, so the three medians do not substitute for one another.

Even one publisher can disagree with itself. Zscaler's press release gives an average ransom payment of $431,995, while its report page shows "$420K average known ransom payment". The metric names differ and no reconciliation is published, so neither figure is used as a headline here. A payment average with no stated population cannot be checked.

Fewer victims are paying, and that changes the picture

The most useful pairing in this category is not a total. It is the payment rate set against a rising count of claimed victims.

Coveware's casework is the longest series with a named owner. The share of victims paying fell from 85% in Q1 2019 to 37% in Q4 2022, and the annual rate fell from 76% in 2019 to 41% in 2022. Later restatements of the 85% baseline by other vendors trace back to this series. Coveware's Q2 2026 report says payment propensity "sank to a new record low" but publishes no numeric rate. Its data-exfiltration-only payment rate, 15% in Q2 2026, is a narrower measure and should not be compared with an overall rate.

Chainalysis reports that the share of ransoms paid "potentially" reached an all-time low of 28% in 2025. It does not publish the denominator, so the figure cannot be read as a continuation of Coveware's series.

Verizon's 2025 DBIR announcement quotes an IDC research vice president saying 64% of victim organisations did not pay a ransom, up from 50% two years earlier, with a median payment of US$115,000. That is breach-corpus analysis from the 2025 report.

Put these beside the leak-site counts. Claimed victims rose in two of the three datasets, while the payment share fell in every source that measures it. Neither trend explains the other. Hold both: more victims are being claimed, and fewer of the victims that responders and blockchain analysts can see are paying.

What ransomware costs, and which figures are forecasts

Three cost figures circulate, and they measure different things.

The $74 billion figure from Cybersecurity Ventures is a forecast. The authors say it comes from "our calculations of global ransomware damage cost predictions from 2015 to 2031". Their definition covers ransom payouts, downtime, lost productivity, IP theft, forensics, legal costs, reputational harm and regulatory fines. Because it is that wide, it cannot be set against payment statistics, and no ratio between them is calculated here.

The $32.3 million in FBI-reported losses is a floor. It covers losses reported to IC3 for calendar 2025 and excludes business disruption, equipment and third-party remediation, so it is not a national cost estimate.

The $1.7 million average recovery cost is a Sophos survey response, with the ransom-inclusion question left open as noted above.

Who gets hit: sectors, countries and company size

Sector counts depend on how a regulator or reporter groups incidents. HIPAA Journal, reporting IC3 data, says healthcare and public health recorded 182 data breaches and 460 ransomware attacks in 2025, within the sector group that experienced the highest number of cyber threats overall among 16 critical infrastructure sectors. CyberScoop lists healthcare, manufacturing, financial services, government and IT as the most heavily targeted. The two healthcare counts are not added together, and the sources do not say healthcare had the highest ransomware count specifically.

Check Point reports that the US share of ransomware victims fell from 50% to 42% between Q1 and Q2 2026. Check Point offers its own explanation for the shift, which is interpretation rather than a demonstrated cause.

Coveware reports a median victim company size of 750 employees in Q2 2026, up 50% from Q1, and adds that employee count "remains a weak predictor of extortion risk". Headcount is a poor proxy for your own exposure.

Zscaler reports that 62% of ransomware victims in its telemetry, April 2025 to March 2026, held manager-level titles or above.

How ransomware attacks work now

Coveware's casework shows lateral movement and data exfiltration tied as the most-observed tactics in Q2 2026, each present in 76% of cases. That describes what responders were called in to handle, not how often each tactic appears across all attacks.

Zscaler's telemetry shows ransomware data theft up 276% year over year, to 896.2 terabytes exfiltrated between April 2025 and March 2026. The report page gives 276%, while the press release rounds the same finding to "more than 275%".

Initial access is where money moves upstream. Chainalysis estimates that initial access brokers received at least $14 million in on-chain payments in 2025, roughly flat on the prior year. Chainalysis compares this with the roughly $820 million in ransom payments, calling the ratio "nearly 58 times", and adds that not all broker payments come from ransomware operators and not every incident is captured. These are two separately estimated aggregates over unmatched populations, so the ratio is not a return on investment for any single intrusion.

What these numbers still do not tell you

Three gaps limit specific uses of these statistics.

First, the leak-site datasets disagree on direction. Check Point, eCrime.ch and Zscaler count different populations over different windows, and no source reviewed here reconciles them. You cannot tell whether they describe one population counted three ways or three separate populations.

Second, payment rates have no shared denominator. Coveware publishes its casework provenance, Chainalysis publishes "potentially 28%" without one, and Verizon's 64% comes from quoted commentary. Check Point's Q2 2026 report also cites a payment rate near 23%, with no methodology on the page. Each rate is usable in its own context, and none can be averaged with another.

Third, no public dataset links complaints, leak-site postings and payments for the same incident, so the overlap among them is unknown. Every figure in this article is therefore a floor, a sample or a model. Settling it would take a consented, anonymised, incident-level dataset with a stated sampling frame and de-duplication across all three record types. None of the sources cited here points to one. Quash has no first-party ransomware data to add.

What to do with these numbers

For a risk memo or budget case, a range with named sources is more defensible than a single figure. Cite the leak-site count with its quarter and owner, the payment rate with its population, and the cost figure with its definition. Before you quote any number, check that its population resembles your organisation. A median ransom from a survey of 100-to-5,000-employee firms does not describe a 50,000-employee enterprise.

If you are writing your own piece, cite the primary behind each figure, not a round-up that collected it. The primary is where the population and period are written down.

Methodology

Each source uses a different method, and the method sets what the number can support.

• Leak-site observation (Check Point, Zscaler): counts of victims posted on extortion sites. It measures public postings, not confirmed attacks, and the public reports describe no de-duplication step.

• Third-party leak-site dataset (eCrime.ch, via Chainalysis): claimed victims, cited through Chainalysis.

• Complaint data (FBI IC3): victim-reported complaints and losses, a floor because many victims do not report.

• On-chain measurement (Chainalysis): payments traceable to wallets attributed to ransomware, revised as more are attributed.

• Incident-response casework (Coveware): payment and tactic data from the firm's own engagements, not a representative sample of all attacks.

• Self-reported survey (Sophos): 2,158 respondents in 17 countries, January to March 2026. Per-question denominators are not published on the report page.

• Breach-corpus analysis (Verizon DBIR): classification of incidents in the year's dataset; the 2025 report describes the prior year.

• Forecast model (Cybersecurity Ventures): a projection with a wide cost definition.