Data Breach Statistics Updated November 2026

Human Written & Fact Checked · Updated

100 Ransomware Statistics for 2026

A ransomware headline can count a confirmed breach, a complaint, a criminal claim or a surveyed victim. Treat those as interchangeable and the comparison fails before the analysis starts. This page keeps each measure tied to the organization that produced it and the population it describes.

Use the breach and complaint sections to understand recorded activity, the European claims sections to examine observed patterns, and the victim survey to assess reported disruption and recovery. Publication dates appear beside every observation. The underlying reference periods differ, and none of these sources is a census of all ransomware attacks.

Headline figures

  • Ransomware appeared in 48% of breaches analyzed for the 2026 DBIR. (Verizon, May 2026)
  • Verizon's ransomware-payment dataset recorded no payment in 69% of cases in 2025. (Verizon, May 2026)
  • IC3 recorded 460 ransomware complaints involving Healthcare and Public Health in 2025. (FBI IC3, Apr 2026)
  • Among IC3 non-critical-sector ransomware complaints, legal services accounted for 18% in 2025. (FBI IC3, Apr 2026)
  • Germany represented 26.5% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • ENISA recorded 52 EU ransomware claims linked to Hunters International in April 2025. (ENISA, Sep 2026)
  • ENISA attributed 25.2% of identified EU ransomware claims to manufacturing in 2025. (ENISA, Sep 2026)
  • Sophos respondents identified malicious email as the ransomware root cause in 26% of incidents. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims reported encryption and data theft in 16% of incidents. (Sophos / Vanson Bourne, Jul 2026)
  • Mean recovery cost excluding ransom in the Sophos survey was $1,700,200. (Sophos / Vanson Bourne, Jul 2026)
  • 66% of Sophos encrypted-data victims used backups to recover encrypted data. (Sophos / Vanson Bourne, Jul 2026)
  • 99% of Sophos encrypted-data victims reported some impact on their IT or cybersecurity team. (Sophos / Vanson Bourne, Jul 2026)

What do the main ransomware datasets actually count?

The denominator counts as much as the headline. A breach dataset and a complaint system reveal different parts of the problem, while payment studies add another selection layer.

How should complaint totals and breach percentages be read?

  • IC3 received 3,611 ransomware complaints in 2025. (FBI IC3, Apr 2026)
  • Reported IC3 ransomware losses totaled $32,320,105 in 2025. (FBI IC3, Apr 2026)
  • IC3 identified 63 new ransomware variants through its reporting in 2025. (FBI IC3, Apr 2026)
  • Ransomware appeared in 65% of education malware-related breaches in the DBIR dataset. (Verizon, May 2026)
  • Ransomware accounted for 61% of manufacturing breaches in the DBIR analysis. (Verizon, May 2026)

IC3 totals describe reports submitted to the FBI, while DBIR sector percentages describe the breaches in Verizon's contributed dataset. Reported losses omit many indirect costs, and incidents reported only to field offices are outside the IC3 measure. These figures therefore cannot establish a global total or a sector's probability of being attacked.

What do payment and credential-linkage studies establish?

  • The same revised DBIR series recorded no payment in 65% of cases in 2024. (Verizon, May 2026)
  • The median share of publicized victims linked to payment was about 9% per ransomware group. (Verizon, May 2026)
  • 27% of ransomware victims in Verizon's linkage analysis had no associated credential or infostealer leak within the preceding year. (Verizon, May 2026)
  • Among linked cases, half had a credential or infostealer event within 95 days before ransomware-victim publication. (Verizon, May 2026)

Verizon observed payment refusal and preceding credential exposure within separate analytical samples. The publicized-victim analysis can miss quick payments and include fabricated criminal claims. Credential linkage also establishes timing and association instead of proving that a particular stolen credential caused the subsequent ransomware event. Keep those qualifications attached when quoting the findings.

Which US sectors appear in ransomware complaints?

Complaint counts identify reported workload and harm, not sector attack rates. Sector size, reporting behavior and classification affect the comparison, so a larger count alone cannot establish weaker security.

Which essential-service sectors reported ransomware?

  • IC3 recorded 24 ransomware complaints involving Emergency Services in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 25 ransomware complaints involving Water/Wastewater in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 34 ransomware complaints involving Defense Industrial Base in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 51 ransomware complaints involving Communications in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 54 ransomware complaints involving Energy in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 59 ransomware complaints involving Chemical in 2025. (FBI IC3, Apr 2026)

IC3 records ransomware complaints across diverse critical infrastructure sectors. The following are counts in the ransomware series, separate from the data-breach series on the same source chart. They do not represent all attacks experienced by those industries, and organizations that never submitted a complaint cannot appear in these totals.

What do the larger infrastructure categories report?

  • IC3 recorded 80 ransomware complaints involving Transportation in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 89 ransomware complaints involving Food and Agriculture in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 164 ransomware complaints involving Commercial Facilities in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 232 ransomware complaints involving Information Technology in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 233 ransomware complaints involving Government Facilities in 2025. (FBI IC3, Apr 2026)
  • IC3 recorded 258 ransomware complaints involving Financial Services in 2025. (FBI IC3, Apr 2026)

The same complaint framework records activity in transport, food, commercial facilities, technology, government and finance. Comparing the counts can help describe the distribution of reported incidents. It does not adjust for the number of organizations, their size or the likelihood that an affected organization reports to law enforcement.

How do manufacturing and non-critical industries differ?

  • IC3 recorded 355 ransomware complaints involving Critical Manufacturing in 2025. (FBI IC3, Apr 2026)
  • Among IC3 non-critical-sector ransomware complaints, contracting services accounted for 17% in 2025. (FBI IC3, Apr 2026)
  • Among IC3 non-critical-sector ransomware complaints, engineering and architectural services accounted for 10% in 2025. (FBI IC3, Apr 2026)
  • Among IC3 non-critical-sector ransomware complaints, consulting services accounted for 7% in 2025. (FBI IC3, Apr 2026)
  • Among IC3 non-critical-sector ransomware complaints, non-critical manufacturing accounted for 5% in 2025. (FBI IC3, Apr 2026)

Critical manufacturing is shown as a complaint count; the other observations below are shares of non-critical-sector ransomware complaints. Their denominators differ and should remain separate. The FBI groups many business activities outside its critical infrastructure categories, so these percentages describe that reported subset instead of the whole ransomware complaint population.

Where were European ransomware claims concentrated?

ENISA's geographic picture follows identified claims. Visibility is uneven, and a criminal group's publication is not independent confirmation that the claimed intrusion or theft occurred.

Which countries followed Germany in observed claims?

  • France represented 14.7% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Italy represented 13.6% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Spain represented 12.2% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • the Netherlands represented 4.7% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Croatia represented 0.5% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)

The listed countries account for different shares of identified EU ransomware claims in ENISA's dataset. These are shares within the observation set instead of rates per organization or per resident. National economic structure, public reporting and visibility of criminal activity can all affect such a distribution without indicating a country's underlying security level.

What do the smaller observed country shares mean?

  • Estonia represented 0.3% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Latvia represented 0.3% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Bulgaria represented 0.3% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Slovakia represented 0.3% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)
  • Lithuania represented 0.1% of EU ransomware claims identified by ENISA in 2025. (ENISA, Sep 2026)

Smaller shares indicate fewer claims in this particular collection, not an absence of ransomware. The reported percentages are rounded, and equal rounded shares do not prove equal incident counts. These observations are suitable for describing ENISA's coverage but should not be converted into a ranking of national resilience or organizational risk.

How did European claims vary over time and sector?

Monthly publication patterns can shift sharply without describing a continuous attack rate. Sector shares add context, but the share of ransomware claims and the share of financially motivated incidents answer different questions.

Which group-specific monthly changes stand out?

  • ENISA recorded 22 EU ransomware claims linked to SafePay in May 2025. (ENISA, Sep 2026)
  • ENISA recorded 26 EU ransomware claims linked to SafePay in December 2025. (ENISA, Sep 2026)
  • ENISA recorded 1 EU ransomware claims linked to Hunters International in February 2025. (ENISA, Sep 2026)
  • ENISA recorded 12 EU ransomware claims linked to Qilin in March 2025. (ENISA, Sep 2026)
  • ENISA recorded 14 EU ransomware claims linked to Qilin in April 2025. (ENISA, Sep 2026)
  • ENISA recorded 11 EU ransomware claims linked to Qilin in May 2025. (ENISA, Sep 2026)

ENISA's monthly series shows changes in claims linked to named groups. These are calendar-month observations of recorded claims, not independently established dates of compromise. A publication burst can reflect reporting behavior or the timing of a group's disclosures, so a sharp movement should not automatically be presented as a matching surge in new attacks.

How does the Qilin series fit the financial-threat picture?

  • ENISA recorded 9 EU ransomware claims linked to Qilin in June 2025. (ENISA, Sep 2026)
  • ENISA recorded 16 EU ransomware claims linked to Qilin in July 2025. (ENISA, Sep 2026)
  • ENISA recorded 17 EU ransomware claims linked to Qilin in August 2025. (ENISA, Sep 2026)
  • ENISA recorded 14 EU ransomware claims linked to Qilin in September 2025. (ENISA, Sep 2026)
  • ENISA recorded 44 EU ransomware claims linked to Qilin in October 2025. (ENISA, Sep 2026)
  • Ransomware deployments represented 47.3% of financially motivated activity recorded by ENISA in 2025. (ENISA, Sep 2026)

Qilin's later monthly observations show variation in the identified claims. The final percentage below switches to ENISA's broader financially motivated activity denominator; it is not a Qilin share. Keeping the two measures distinct avoids turning a group-specific timeline into an estimate of the entire cybercrime market.

How should ransomware sector shares be compared?

  • ENISA attributed 18.7% of identified EU ransomware claims to business services in 2025. (ENISA, Sep 2026)
  • ENISA attributed 10.7% of identified EU ransomware claims to other sectors in 2025. (ENISA, Sep 2026)
  • ENISA attributed 5.2% of identified EU ransomware claims to health in 2025. (ENISA, Sep 2026)
  • Within ENISA's financially motivated manufacturing incidents, ransomware represented 82.8% in 2025. (ENISA, Sep 2026)
  • Within ENISA's financially motivated business services incidents, ransomware represented 65.4% in 2025. (ENISA, Sep 2026)
  • Within ENISA's financially motivated health incidents, ransomware represented 26.8% in 2025. (ENISA, Sep 2026)

The first figures describe the sector distribution of ransomware claims. The remaining figures describe ransomware within financially motivated incidents in each named sector. Those perspectives are complementary, but reversing their denominators would materially change the claim. ENISA's public-administration share is omitted because its text and chart do not agree.

What did surveyed victims report about access and encryption?

Victim surveys reveal reported experiences among affected organizations. They do not estimate the chance that an arbitrary organization will be attacked, and perceived contributors should not be mistaken for independently proven causes.

Which entry routes and locations were reported?

Sophos asked ransomware-hit organizations about their incidents. The location breakdown applies only to attacks attributed to compromised credentials, exploited vulnerabilities or brute force; it excludes other root-cause categories. Root causes and locations therefore use different bases.

What operational weaknesses did victims identify?

  • Sophos victims cited lack of protection as an operational contributor in 36.4% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited unknown security gaps as an operational contributor in 36.3% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited known security gaps as an operational contributor in 36% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited lack of people or capacity as an operational contributor in 35.3% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited human error as an operational contributor in 35.3% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited lack of expertise as an operational contributor in 35.1% of responses. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims cited poor-quality protection as an operational contributor in 32.6% of responses. (Sophos / Vanson Bourne, Jul 2026)

Respondents could identify several operational contributors, so percentages are not mutually exclusive. These assessments describe perceived gaps. They do not establish that any single weakness caused the attack or quantify its causal effect.

What outcomes were reported before and after encryption?

  • Sophos victims reported data encryption without reported theft in 40% of incidents. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims reported extortion without encryption in 2% of incidents. (Sophos / Vanson Bourne, Jul 2026)
  • Sophos victims reported the attack being stopped before encryption in 41% of incidents. (Sophos / Vanson Bourne, Jul 2026)

The survey distinguishes encryption from extortion and from an attack being stopped. Its encrypted-and-stolen category is reported in the takeaways instead of repeated below. Categories are rounded, and the source's totals should not be reverse-engineered into precise incident counts. An attack stopped before encryption can still consume response resources; it is not equivalent to an organization experiencing no security incident. Likewise, reported encryption does not by itself establish whether all affected data were lost permanently or whether usable backups existed.

What did ransomware recovery cost and involve?

A ransom payment is only one component of harm. Recovery spending, time and pressure on staff remain distinct outcomes, and the different respondent bases make apparently conflicting payment estimates possible.

How do demands, payments and recovery costs differ?

Demand and payment summaries do not necessarily describe identical respondents. Extreme demands were excluded, while the paired comparison uses only organizations reporting both amounts. Recovery costs explicitly exclude ransom payments. These are distinct respondent bases, not individual trajectories.

How did encrypted-data victims recover and how long did recovery take?

The data-recovery observations apply to victims whose data were encrypted, while the timing observations cover surveyed ransomware victims more broadly. Recovery methods can overlap, so paying and using backups are not exclusive strategies. Cumulative recovery-time percentages should also not be added together or compared directly with exclusive duration bands.

What effects were reported by IT and security teams?

  • 41% of Sophos encrypted-data victims reported increased anxiety or stress about future attacks. (Sophos / Vanson Bourne, Jul 2026)
  • 40% of Sophos encrypted-data victims reported increased pressure from senior leaders. (Sophos / Vanson Bourne, Jul 2026)
  • 36% of Sophos encrypted-data victims reported increased recognition from senior leaders. (Sophos / Vanson Bourne, Jul 2026)

Encrypted-data victims reported consequences for the people responding to the incident. The source allowed multiple impacts, so recognition and pressure can coexist within the same organization. These responses capture organizational reports about teams instead of clinical assessments of individual workers. They also do not establish how long an impact persisted after recovery. For workforce planning, the useful distinction is between restoring systems and addressing the reported human consequences of the disruption. Neither the survey nor these statistics estimates the effectiveness of a particular staff-support intervention.

Glossary

Methodology and sources

Every figure on this page comes from the organisation that produced it: regulators, statistics offices, public bodies, research institutes, and companies reporting their own data or surveys. Each one links to the original report or dataset and carries its release date. Survey results keep their population and fieldwork period, and financial figures keep the measure the producer used. Figures from different producers are not added together or ranked against each other. The page is reviewed monthly and updated when a producer releases newer data.