Ransomware Statistics 2026: Attacks, Entry Points, Payments and Recovery

Ransomware groups had posted 8,558 victims to their leak sites in 2026 by 25 October, already more than the 8,146 posted in all of 2025, according to the public tracker ransomware.live. NCC Group counted a record 7,874 ransomware attacks in 2025, up 50% on 2024, and Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of the breaches it analyzed. The money moved the other way: Chainalysis traced about US$820 million in on-chain ransom payments in 2025, 8% less than in 2024. More organizations are being hit, and fewer of them are paying.

Four forces shape ransomware in 2026. Payment rates keep falling: Coveware measured 19% of its cases paying in Q2 2026, the lowest in its series. The way in has moved toward identity: Sophos's State of Ransomware 2026 found malicious email and phishing behind 50% of attacks, with exploited vulnerabilities down from 32% to 18%. Recovery is the expensive part, at a mean of US$1.7 million before any ransom in the same survey. And the ecosystem keeps fragmenting, with 157 groups posting victims so far in 2026 against 126 in 2025 (ransomware.live). This page is for CISOs, journalists, researchers, insurers and students who need each figure with its source.

This post is the Stingrai research team's 2026 reference for ransomware statistics. It brings together more than 100 figures from 21 primary publishers: ransomware.live, NCC Group, Chainalysis, Coveware, Sophos, Verizon, IBM, Mandiant, the FBI's Internet Crime Complaint Center, the US Department of Health and Human Services, CISA, Europol, ENISA, the US Department of Justice, the UK's National Crime Agency, National Cyber Security Centre and Department for Science, Innovation and Technology, the Canadian Centre for Cyber Security and Communications Security Establishment, the Australian Signals Directorate and Coalition, plus Stingrai's own analysis of CISA's KEV catalog and of 1,206 verified penetration test findings. Lead data is full-year 2025 telemetry, the freshest available, plus 2026 year-to-date counts where publishers release them monthly or quarterly; most primary publishers have not released full-year 2026 reports as of October 2026. Every stat carries its source, year and methodology window so any claim can be audited inline.

Quick answer. Ransomware leak sites carried 8,146 victim postings in 2025 (ransomware.live) and NCC Group counted a record 7,874 attacks, up 50%. By 25 October 2026 the 2026 count had already reached 8,558. Fewer victims pay: about US$820 million was paid on-chain in 2025 (Chainalysis), and only 19% of Coveware's Q2 2026 cases paid. Malicious email and phishing (50%), compromised credentials (23%) and exploited vulnerabilities (18%) were the leading root causes in Sophos's 2026 survey, and the mean recovery cost, excluding any ransom, was US$1.7 million.

TL;DR: 16 key ransomware statistics

• Leak-site victim postings, 2026 to 25 October: 8,558, already above the 8,146 for all of 2025 (ransomware.live, read 25 October 2026).

• Ransomware attacks in 2025 (NCC Group): 7,874, a record and up 50% on 2024 (NCC Group, Annual Cyber Threat Intelligence 2025).

• Coveware payment rate (Q2 2026): 19% of cases paid, the lowest in a series that started at 85% in Q1 2019 (Coveware, Q2 2026 report).

• On-chain ransom payments (2025): about US$820 million, down 8% from a revised US$892 million in 2024 (Chainalysis, 2026 Crypto Crime Report).

• Breaches involving ransomware (Verizon 2026 DBIR): 48%, up from 44%; 69% of ransomware victims did not pay (Verizon, 2026 DBIR).

• Share of ransomware victims that were small and medium-sized businesses (Verizon): about 96%, where organization size was known (Verizon, 2026 DBIR).

• Root causes in Sophos's 2026 survey: malicious email 26%, phishing 24%, compromised credentials 23%, exploited vulnerabilities 18% (Sophos, State of Ransomware 2026).

• Mean recovery cost, excluding any ransom (2026 survey): US$1.7 million, up 11% (Sophos).

• Median ransom payment (2026 survey): US$769,000, down from US$1 million (Sophos).

• Coveware Q2 2026 median and average payment: US$150,000 median, US$1,880,612 average (Coveware).

• Groups posting victims: 157 in 2026 to date, 126 in 2025, 95 in 2024 (ransomware.live).

• Most active group: Qilin, 13.0% of 2025 postings and 13.2% of 2026 postings to date; the top five groups held 38.1% in 2025 (ransomware.live; Stingrai calculation).

• Breached organizations hit by ransomware (IBM 2026): 39%, up from 24% in 2023 (IBM, Cost of a Data Breach Report 2026).

• Ransomware complaints to the FBI (2025): 3,611, up 14%; healthcare filed the most of any critical infrastructure sector, 460 (FBI IC3, 2025 Internet Crime Report).

• CISA KEV vulnerabilities flagged for known ransomware use: 361 of 1,756 (20.6%), 117 of them Microsoft (Stingrai analysis of the CISA KEV feed, 25 October 2026).

• Stingrai penetration test data: outdated or unpatched software is 56.9% of internal network findings, and the median finding with a tracked fix time takes 26 days to fix (Critical 10.5 days, High 38) (State of Penetration Testing 2026).

Key takeaways

• 2026 is on course to be the highest year on record for leak-site postings. ransomware.live recorded 7,653 postings from January to September 2026, 34% more than in the same months of 2025, and passed the full-year 2025 total before the end of October (Stingrai calculations).

• Attack volume and ransom income have decoupled. Claimed victims rose 50% in 2025 while on-chain payments fell 8% (Chainalysis), and Coveware's payment rate has fallen from 85% in Q1 2019 to 19% in Q2 2026. Backups help: 66% of organizations whose data was encrypted recovered from backups in Sophos's 2026 survey, up from 54%.

• Identity is the common thread in how ransomware gets in. Sophos found 79% of attacks started with an identity-based approach, Verizon found stolen credentials and exploited vulnerabilities tied at 39% in System Intrusion breaches, and Mandiant found prior compromise, access gained in an earlier intrusion, was the top vector in ransomware operations at 30%.

• Attackers work in hours; fixes take weeks. Sophos's median time from entry to Active Directory was 3.4 hours, while the median finding in Stingrai's penetration tests took 26 days to resolve and High findings took 38. Verizon's median for fully fixing a CISA KEV vulnerability was 43 days.

• Small organizations carry most of the volume. About 96% of ransomware victims in Verizon's data, where size was known, had fewer than 1,000 employees, and the UK's 2026 breaches survey extrapolates about 9,000 UK businesses that experienced ransomware.

Methodology

Counting rules. Ransomware is measured in at least five different ways, and they are not interchangeable:

• Leak-site postings are not attacks. Trackers such as ransomware.live count victims that ransomware groups name on their data leak sites. Victims who pay quietly usually never appear; some postings are duplicates, reposts of old breaches or false claims, and ransomware.live has removed groups whose claims it could not verify. Verizon estimates the median share of publicized victims that paid, per group, at about 9%.

• Payments are not incidents. Chainalysis counts on-chain payments to wallets it can attribute, and revises earlier years as attribution improves. Coveware reports the cases its incident response team handled, quarter by quarter.

• Surveys and telemetry measure different populations. Sophos surveyed 2,158 IT and security leaders at organizations of 100 to 5,000 employees that were hit; IBM's figures come from 602 breached organizations; Verizon codes breaches from its contributors; the FBI counts complaints people chose to file. A median from one population cannot be compared with a median from another.

• Government counts are floors. The FBI calls its ransomware loss figure "artificially low", and the Canadian Centre for Cyber Security says real incident numbers are almost certainly higher than those it sees.

• Stingrai counts. Where a figure is labelled a Stingrai calculation or analysis, it is computed from the publisher's own data: the CISA KEV JSON feed (catalog version 2026.10.23, downloaded 25 October 2026), the HHS OCR breach portal (both the under-investigation list and the archive, exported 25 October 2026), CISA's advisory listings, and ransomware.live's statistics pages (read 25 October 2026).

Sources and windows. ransomware.live and NCC Group: calendar months to September or October 2026. Chainalysis, NCC Group annual, FBI IC3, Coalition: calendar 2025. Coveware: quarters to Q2 2026. Sophos State of Ransomware 2026: survey of January to March 2026 covering the previous 12 months. Sophos Active Adversary Report 2026: 661 cases from 1 November 2024 to 31 October 2025. Verizon 2026 DBIR: 1 November 2024 to 31 October 2025. IBM 2026: March 2025 to February 2026. Mandiant M-Trends 2026: 2025 investigations. ENISA Threat Landscape 2025: 1 July 2024 to 30 June 2025. Stingrai penetration test data: findings logged from October 2024 to August 2026. Research cutoff: 25 October 2026.

What was dropped. Sophos's 2026 survey no longer publishes an attack rate, so no "share of organizations hit" figure from Sophos appears here. IBM's 2026 report does not publish a ransomware-specific breach cost, so IBM's attacker-disclosed figure is quoted from its 2025 edition and labelled as such. Coveware's attack-vector shares appear only in an unlabeled chart and were not estimated. Stats that could not be confirmed against a named primary source on at least one verification pass were dropped rather than estimated, including widely repeated "an attack every X seconds" claims.

How many ransomware attacks were there in 2025 and 2026 so far?

8,146 victims were posted to ransomware leak sites in 2025, according to ransomware.live, up 33% from 6,112 in 2024 (Stingrai calculation). NCC Group, which runs its own leak-site monitoring, counted 7,874 attacks in 2025, a record and 50% more than 2024, and Chainalysis, using eCrime.ch data, also reports a 50% rise in claimed victims, "the most active year on record". The trackers differ in how they deduplicate and which sites they monitor, so cite each count with its tracker.

2026 is running ahead of 2025 on ransomware.live's count. ransomware.live recorded 7,653 postings from January to September 2026, 34% more than the 5,710 in the same months of 2025, and 8,558 by 25 October 2026, which already exceeds the 2025 total. August 2026 was the highest month in its series, at 1,149. NCC Group's count peaked in the same month: 1,073 attacks in August 2026, its high for the year and just below its record of 1,099 in February 2025, before falling 26% to 821 in September; NCC Group counted 23% more attacks in Q3 2026 than in Q2.

Figure 1: Ransomware leak-site victim postings per month, January 2024 to September 2026. Source: ransomware.live statistics, read 25 October 2026.

Leak-site counts measure extortion claims, and complaint counts measure what victims report to the FBI, which is why the FBI's 3,611 is less than half of either tracker.

Which ransomware groups are most active?

Qilin was the most active ransomware group of 2025 on every tracker reviewed: 1,058 postings (13.0%) on ransomware.live, 1,022 attacks (13%) in NCC Group's count, and the dominant family named by Europol. It remains first in 2026, with 1,127 postings to 25 October (13.2%).

Source: ransomware.live 2025 and 2026 statistics pages; shares are Stingrai calculations against 8,146 and 8,558 postings.

The top five groups held 38.1% of 2025 postings and 37.3% of 2026 postings so far, and the top ten about half, so the long tail matters: ransomware.live counted 126 groups posting victims in 2025 and 157 in 2026 to date, including 82 new names this year. Europol observed "more than 120 active ransomware brands" in 2025, and ENISA recorded 82 ransomware variants deployed against EU organizations between July 2024 and June 2025, led by Akira (11.6%), SafePay (10.1%) and Qilin (7.5%).

Three shifts stand out. The Gentlemen, absent from the 2025 top ten, is the second most active group of 2026 and carried 15% of NCC Group's July attacks, before Qilin took back first place in August. LockBit, whose claims ENISA notes stopped after a May 2025 database leak, is back in the top ten as LockBit 5.0. And incident responders see a different mix from leak sites: Coveware's Q2 2026 caseload was led by Lone Wolf (17%), ShinyHunters (12%), Akira (9%) and The Gentlemen (8%), while Sophos's Active Adversary Report put Akira at 22.58% of attributed ransomware cases, with Akira, Qilin, SafePay, INC and Play together making up 51%.

In the US, the FBI's IC3 identified 63 new ransomware variants in 2025, and its ten most reported (Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa) accounted for 56.8% of ransomware incidents reported to it.

How do ransomware attackers get in?

No single entry point dominates; it depends on who is counting. The three largest 2026 datasets each put a different vector first, and all three point at identity:

• Sophos State of Ransomware 2026 (2,158 victims, survey): malicious email (26%) and phishing (24%) together caused half of attacks, compromised credentials 23% and exploited vulnerabilities 18%, down from 32% a year earlier. 79% of attacks began with an identity-based approach, and multi-factor authentication was in place in some form in 97% of the incidents rooted in compromised credentials.

• Verizon 2026 DBIR (System Intrusion breaches, where ransomware appears in 77%): stolen credentials and exploited vulnerabilities tied at 39% each. Among small and medium-sized ransomware victims, compromised credentials (38%) and unpatched edge-device vulnerabilities (29%) were the common thread.

• Sophos Active Adversary Report 2026 (661 incident response and MDR cases of all types): compromised credentials 42.06%, exploited vulnerabilities 16.04%, brute force 15.58% and phishing 6.35%; MFA was missing or incomplete in 59.46% of incidents.

Figure 2: Initial access vector or root cause shares in three 2026 datasets, each on its publisher's own base. Sources: Sophos, State of Ransomware 2026; Verizon, 2026 DBIR; Sophos, 2026 Active Adversary Report.

Other primary sources fill in the picture:

• Bought access. Mandiant M-Trends 2026 found prior compromise was the top initial infection vector in ransomware operations, at 30%, double the 15% of 2024, and the median hand-off from initial access to a secondary threat group fell from more than eight hours in 2022 to 22 seconds in 2025. Across all its intrusions, exploits led for the sixth year (32%).

• Credential leaks before the attack. Verizon found that among ransomware victims with a credential or infostealer leak in the year, half had one within 95 days before they appeared on a leak site; 27% of victims had no such leak at all.

• Where the root cause sat. Of the Sophos 2026 attacks that started with an exploited vulnerability, compromised credentials or brute force, exposed applications and systems were the entry point in 38%, user devices in 30% and firewalls in 21%.

• Social engineering is back in the lead. Coveware reported that phishing and social engineering "moved back into the lead" in Q2 2026, after remote access compromise dominated Q4 2025.

Which vulnerabilities do ransomware groups use?

361 of the 1,756 vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog, 20.6%, are flagged "Known" for use in ransomware campaigns, in Stingrai's analysis of the KEV JSON feed (catalog version 2026.10.23, downloaded 25 October 2026). They span 81 vendors, but ten vendors account for 214 of them (59.3%), and Microsoft alone for 117 (32.4%), led by Windows (48 entries) and Exchange Server (13).

Figure 3: CISA KEV entries with knownRansomwareCampaignUse set to "Known", top 10 vendors. Source: Stingrai analysis of the CISA KEV catalog, version 2026.10.23, downloaded 25 October 2026.

Source: Stingrai analysis of the CISA KEV JSON feed, 25 October 2026. Vendor names as given in the feed's vendorProject field.

The last column is the more useful one for patch prioritization. More than two thirds of SonicWall's KEV entries and four in five of QNAP's carry the ransomware flag, against about three in ten of Microsoft's, which reflects how heavily ransomware crews favor network appliances, VPNs and storage devices that sit on the internet edge. Twenty-seven of the flagged entries were added to KEV in 2026, including Cisco Secure Firewall Management Center, SonicWall SMA1000, SmarterMail, SimpleHelp, BeyondTrust Remote Support, JetBrains TeamCity and VMware vCenter vulnerabilities. CISA sets the flag when it knows of ransomware use, often months after an entry is added, so these counts only go up. For the full KEV and CVE picture, see Vulnerability Statistics 2026.

How fast does ransomware move compared with how fast organizations fix things?

3.4 hours was the median time from an attacker's entry to reaching Active Directory in the 661 incidents of Sophos's 2026 Active Adversary Report, and the median dwell time across those cases was three days (five for incident response cases, two for MDR customers). Data exfiltration happened at a median of 78.83 hours from the start of the attack, and 88.1% of ransomware was deployed outside local business hours. Mandiant measured a global median dwell time of 14 days in 2025 across all intrusions it investigated, and estimates the mean time to exploit a vulnerability at minus seven days, meaning exploitation often comes before a patch.

Fixes run on a different clock. In Stingrai's own penetration test data, the 163 findings with a tracked resolution time took a median of 26 days to resolve, and the slowest tenth took 121 days or more. Critical findings were resolved fastest, at a median of 10.5 days, while High findings took 38 days, 3.6 times as long (Stingrai calculation). Verizon's 2026 DBIR found the median time to fully fix a CISA KEV vulnerability rose to 43 days, from 32, and only 26% of KEV vulnerabilities were fully remediated.

Figure 4: Published attacker timings against remediation times, on a log scale. Sources: Sophos, 2026 Active Adversary Report; Mandiant, M-Trends 2026; Verizon, 2026 DBIR; Stingrai, State of Penetration Testing 2026.

Source: Stingrai penetration testing platform, 55 penetration tests, findings logged October 2024 to August 2026. The by-severity cells are small, so read them as indicative.

The gap that matters for ransomware is the High tier. Patch debt, such as an outdated service on an internal server, is usually rated High rather than Critical, and in this dataset High findings waited 3.6 times as long as Critical ones. Those are the issues a ransomware affiliate uses to move from a first foothold to domain administrator.

What ransomware costs: ransom paid, payment rate and recovery

About US$820 million was paid to ransomware groups on-chain in 2025, down 8% from a revised US$892 million in 2024, according to Chainalysis, which expects the total to approach or exceed US$900 million as more payments are attributed. The median on-chain payment rose 368%, from US$12,738 to US$59,556, and Chainalysis estimates the share of claimed victims who paid fell to a potential all-time low of 28%.

Coveware's incident response data shows the same decline in paying, quarter by quarter:

Sources: Coveware quarterly reports for Q1 2025, Q2 2025, Q3 2025, Q4 2025, Q1 2026 and Q2 2026; payment rates as labelled on Coveware's quarterly payment resolution chart in the Q2 2026 report.

Coveware attributes the Q2 2026 jump in the average to "a handful of unusually high" payments, many from the Silent Ransom group's data-theft extortion campaign against law firms, while the median halved. When data theft was the only threat, just 15% of its Q2 2026 victims paid.

The medians differ by a factor of five or more because the populations differ: Sophos surveys organizations of 100 to 5,000 employees, Coveware sees the cases it negotiates, Verizon codes loss records and Chainalysis counts every attributable wallet payment. Compare each figure only with its own earlier values. Recovery, not the ransom, is the larger bill for most victims: in Sophos's survey the mean recovery cost was more than twice the median payment. IBM's 2026 report puts the global average cost of a breach of any kind at a record USD 4.99 million and found that 41% of ransomware attacks threatened the victim's brand reputation, through public shaming and leaks to the media. For the full payment dataset, including payment methods, laundering and the largest known ransoms, see Ransomware Payout Statistics 2026.

Ransomware and cyber insurance

US$269,000 was the average loss on a ransomware claim in 2025 for Coalition, which insures more than 100,000 policyholders in the United States, Canada, the United Kingdom, Australia and Germany; ransomware was its most costly claim type. Initial ransom demands rose 47%, a record 86% of businesses refused to pay, and 70% of ransomware claims involved both encryption and data theft, and ransomware attacks involving data theft were more than twice as expensive. Business email compromise and funds transfer fraud still made up 58% of the incidents Coalition saw. See Cyber Insurance Statistics 2026.

Who gets hit: industries, SMB and enterprise, healthcare, education, government

Manufacturing was the most posted sector on ransomware leak sites in both 2025 (1,565 postings) and 2026 to date (1,463), ahead of professional services and technology (ransomware.live). NCC Group's 2025 count agrees, with industrials taking 2,190 attacks, up 54%, and ENISA found manufacturing was the sector most targeted by ransomware claims in the EU (14.9%).

Source: ransomware.live statistics pages, read 25 October 2026; sector assignments are the tracker's.

Small businesses and enterprises

About 96% of ransomware victims in Verizon's 2026 DBIR, where size was known, were organizations with fewer than 1,000 employees. Coveware's Q2 2026 caseload was centered on mid-market firms: the largest band was 101 to 1,000 employees (35.4%), organizations above 10,000 employees made up 19.2%, and the median victim had 750 employees. Larger organizations stop more attacks before encryption in Sophos's survey, but no size band is exempt. See Small Business Cybersecurity Statistics 2026.

Healthcare

460 ransomware complaints came to the FBI from healthcare and public health organizations in 2025, the most of any critical infrastructure sector, ahead of critical manufacturing (355), financial services (258), government facilities (233) and information technology (232) (FBI IC3). Healthcare was also the largest sector in Coveware's Q1 2026 caseload (17.6%) and second in Q2 2026 (14.1%), and healthcare postings on ransomware.live are higher in 2026 to date (768) than in all of 2025 (639).

The HHS Office for Civil Rights breach portal, which lists US health data breaches affecting 500 or more people, recorded 653 hacking or IT incidents submitted in 2025, 80.9% of the 807 breaches reported that year, affecting 135.0 million individuals' records, 95.6% of the year's total (Stingrai count). From January to 5 October 2026, it listed 512 hacking or IT incidents out of 598 breaches, affecting 76.8 million records. The portal has no ransomware field: "Hacking/IT Incident" is the category that contains ransomware, alongside other intrusions, so these counts are an upper bound for ransomware. They combine the portal's under-investigation list and its archive, by breach submission date, as exported on 25 October 2026. See Healthcare Data Breach Statistics 2026.

Education and government

344 education organizations were posted on ransomware leak sites in 2025 and 287 in 2026 to 25 October, alongside 345 and 294 government and defense organizations (ransomware.live). In the UK, academia topped the list of sectors reporting ransomware to the National Cyber Security Centre in its 2025 review year, ahead of finance, engineering, retail, health and manufacturing. In the US, government facilities filed 233 ransomware complaints with the FBI in 2025. See Education Data Breach Statistics 2026.

Regional snapshot: United States, United Kingdom, Canada, EU and Australia

The United States accounted for 47.7% of 2025 leak-site postings on ransomware.live (3,886 of 8,146) and 37.8% of 2026 postings to date (Stingrai calculations); NCC Group put North America at 56% of 2025 attacks.

Sources: ransomware.live; FBI IC3; DSIT, Cyber Security Breaches Survey 2025/2026; Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025-2027; ENISA Threat Landscape 2025; ASD, Annual Cyber Threat Report 2024-25.

United Kingdom. The breaches survey shows ransomware hitting about 1% of UK businesses, down from 3%, while the National Cyber Security Centre handled 204 nationally significant incidents in the year to August 2025, up from 89. The 2026 NCSC Annual Review had not been published at the research cutoff.

Canada. The Canadian Centre for Cyber Security calls ransomware the top cybercrime threat to Canada's critical infrastructure. Its Ransomware Threat Outlook names Akira, Play and Medusa as the top three threats to Canada in 2024 and says the real number of incidents and payments is almost certainly higher than it sees. Canada had the second-highest count of victims on ransomware leak sites in 2025, and the Communications Security Establishment reports acting against 10 of the most significant ransomware groups in fiscal 2025-26. See Cyber Attacks in Canada: Statistics for 2026.

European Union. ENISA analyzed 4,875 incidents from July 2024 to June 2025; cybercrime was 13.4% of them, and ransomware made up 81.1% of the cybercrime activity it recorded.

Australia. The ASD's Australian Cyber Security Centre responded to 138 ransomware incidents in FY2024-25, 39% of which came to light because the ACSC warned the organization first. Since 30 May 2025, businesses with an annual turnover of A$3 million or more must report ransom payments. The 2025-26 report had not been published at the research cutoff, so these figures were read from ASD's report page as archived by the Internet Archive in September 2026.

Law enforcement takedowns and sanctions

Law enforcement has disrupted ransomware infrastructure every year since Operation Cronos, and the targets have widened from ransomware brands to the laundering, hosting and anonymity services around them.

The effect on group rankings is visible. NCC Group notes that LockBit 3.0, the most prolific group of 2024, fell out of its 2025 top ten after sustained enforcement, and the NCA reported a 73% fall in average monthly LockBit attacks in the UK after Cronos. Displacement is visible too: affiliates move to other brands, and LockBit reappeared in 2026 as LockBit 5.0.

CISA and its partners have published at least 26 #StopRansomware advisories since June 2022, each profiling one group's tactics, indicators and mitigations, by Stingrai's count of CISA's advisory listings: two so far in 2026, on Gunra (August) and SafePay (20 October 2026). The SafePay advisory lists five exploited CVEs, including firewall and backup-software flaws, and its first recommendation is to patch firewalls and other edge devices.

What 1,206 penetration test findings say about ransomware entry points

Outdated or unpatched software made up 56.9% of internal network findings in Stingrai's State of Penetration Testing 2026, drawn from 55 penetration tests and 1,206 verified findings logged between October 2024 and August 2026. That is the layer a ransomware affiliate works in after the first foothold, between initial access and the domain controller.

Source: Stingrai penetration testing platform data, October 2024 to August 2026, extracted 29 August 2026. It is one firm's book of work, not an industry sample.

Three patterns line up with the published ransomware data:

• The perimeter looks clean; the inside does not. External network tests produced a median of one finding, while internal network tests produced a median of 11, 92% of them High or Critical. Ransomware crews that buy access or log in with stolen credentials skip the perimeter and land in exactly the estate where outdated software dominates.

• Identity weaknesses lead in applications. Authentication and session handling was the largest class in web application testing (28.1%), and across the whole dataset it was the largest class of Critical findings. That matches the identity-led root causes in Sophos's and Verizon's 2026 data.

• The High tier is where fixes stall. Outdated software is the single largest block of High and Critical findings (28.6%), and High findings took a median of 38 days to resolve against 10.5 days for Critical ones. A Critical gets an owner and a deadline; the High that lets an attacker move laterally waits in the backlog.

What this means for defenders

• Treat identity as the primary ransomware control. Most 2026 datasets put credentials and phishing first, and MFA was present in 97% of Sophos's credential-led incidents, so test the paths around MFA: help desk resets, session theft, legacy protocols and service accounts. Phishing-resistant MFA and monitoring of infostealer exposure close the gaps Verizon's 95-day credential-leak window describes.

• Patch the edge first, using the ransomware flag. Filter the CISA KEV catalog on knownRansomwareCampaignUse and set a shorter deadline for those entries, especially firewalls, VPNs, remote access tools, file transfer servers and backup software, which recur across KEV, the SafePay advisory and Verizon's SMB data.

• Put a deadline on High findings, not only Critical ones. In Stingrai's data, High findings waited 3.6 times as long as Critical ones. Internal outdated software and Active Directory weaknesses are what turn a foothold into encryption, so test the internal network and Active Directory, not only the perimeter, with an internal and external network penetration test.

• Rehearse the full chain, not single controls. Sophos's median of 3.4 hours to Active Directory and the 88.1% of ransomware deployed outside business hours mean detection and response have to work at night and on weekends. An assumed-breach red team engagement tests whether a foothold becomes domain-wide encryption before anyone notices.

• Make recovery the plan, and measure it. Backups were used in 66% of Sophos's encrypted cases and 55% of victims recovered within a week. Keep offline, immutable copies, test restores against a recovery time objective, and decide the payment and reporting policy before an incident: the UK's survey found 49% of businesses already have a no-pay rule, and Australia requires businesses with a turnover of A$3 million or more to report a ransom payment within 72 hours.

Where Stingrai fits. Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. For ransomware entry points, Stingrai's internal network testing works from a foothold to the domain, covering lateral movement, privilege escalation, segmentation and the Kerberos, delegation and ACL attack paths in Active Directory, while its red team engagements run assumed-breach and threat intelligence-led scenarios against the identity, help desk and remote access paths ransomware crews use. Engagements are run from Toronto and London by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team. Every confirmed finding is posted to the PTaaS platform with a working proof of concept and remediation guidance as soon as it is confirmed, retesting of remediated findings is included, and every human-led and hybrid report ships with an attestation letter, delivered as a one-time annual test or a continuous program. For web applications and associated APIs, Stingrai's autonomous AI penetration testing agent, Snipe, which includes an AI and LLM sub-agent, hunts broken authorization, business logic and injection flaws.

How to cite this page

Stingrai Research Team. "Ransomware Statistics 2026: Attacks, Entry Points, Payments and Recovery." Stingrai, 25 October 2026. https://www.stingrai.io/blog/ransomware-statistics-2026

Cite single figures to their primary source. Cite figures marked as a Stingrai calculation, count or analysis (the KEV vendor analysis, the HHS OCR counts, the #StopRansomware count, the leak-site shares and the penetration test data) to this page with the date 25 October 2026.

This compilation is licensed under CC BY 4.0.

Frequently Asked Questions

How many ransomware attacks were there in 2025?

Ransomware groups posted 8,146 victims to their leak sites in 2025, according to ransomware.live, up 33% from 6,112 in 2024, and NCC Group counted a record 7,874 attacks, up 50%. These are claims made on leak sites, so they miss victims who paid quietly and include some duplicates and false claims.

How many ransomware attacks have there been in 2026 so far?

ransomware.live recorded 8,558 leak-site victim postings in 2026 by 25 October, already more than in all of 2025, and 7,653 from January to September, 34% more than in the same months of 2025. August 2026 was the highest month in its series, at 1,149.

What percentage of ransomware victims pay the ransom?

Fewer than ever. Coveware measured 19% of its cases paying in Q2 2026, down from 85% in Q1 2019, and Chainalysis estimates 28% of claimed victims paid in 2025. Verizon's 2026 DBIR found 69% of ransomware victims did not pay, and in Sophos's 2026 survey 48% of organizations whose data was encrypted paid.

What is the average ransomware payment in 2026?

It depends on the dataset. Coveware's Q2 2026 average was US$1,880,612 and its median US$150,000; Sophos's 2026 survey put the median payment at US$769,000; Verizon's median ransom paid was US$139,875; and the median on-chain payment traced by Chainalysis in 2025 was US$59,556.

How do ransomware attackers get in?

Mostly through identity. In Sophos's 2026 survey, malicious email and phishing caused 50% of ransomware attacks, compromised credentials 23% and exploited vulnerabilities 18%. Verizon's 2026 DBIR found stolen credentials and exploited vulnerabilities tied at 39% in System Intrusion breaches, and Mandiant found prior compromise, access gained in an earlier intrusion, was the top vector in ransomware operations, at 30%.

Which ransomware groups are most active in 2026?

Qilin, with 1,127 leak-site postings to 25 October 2026 (13.2%), followed by The Gentlemen (927), Akira (422), INC Ransom (384) and DragonForce (329), according to ransomware.live. Qilin was also the most active group of 2025 on both ransomware.live and NCC Group's count.

Which industries are hit hardest by ransomware?

Manufacturing had the most leak-site postings in 2025 (1,565) and in 2026 to date (1,463), ahead of professional services and technology. Healthcare filed the most ransomware complaints of any US critical infrastructure sector with the FBI in 2025 (460).

How much does it cost to recover from a ransomware attack?

The mean recovery cost in Sophos's 2026 survey was US$1,700,200, excluding any ransom, up 11%. IBM's 2025 report put the average cost of an attacker-disclosed ransomware or extortion breach at US$5.08 million, and Coalition's average ransomware insurance claim in 2025 was US$269,000.

How many vulnerabilities are linked to ransomware in the CISA KEV catalog?

361 of the 1,756 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog (20.6%) were flagged for known ransomware use as of the 23 October 2026 catalog, in Stingrai's analysis. Microsoft accounts for 117 of them, followed by Fortinet (14), SonicWall (13) and Oracle (13).

How fast does ransomware spread after initial access?

Fast. Sophos's 2026 Active Adversary Report found a median of 3.4 hours from entry to Active Directory and a median dwell time of three days, and Mandiant found the hand-off from initial access to a second threat group took a median of 22 seconds in 2025.

Related reading

• Ransomware Payout Statistics 2026

• Vulnerability Statistics 2026

• Phishing Statistics 2026

• Data Breach Statistics 2026

• Cybercrime Statistics 2026

• Compromised Credential Statistics 2026

• Zero-Day Statistics 2026

• The State of Penetration Testing 2026

References

1. ransomware.live. Ransomware Statistics (all time, 2024, 2025, 2026). Read 25 October 2026. https://www.ransomware.live/stats. Victims posted on ransomware data leak sites, by month, group, sector and country.

2. NCC Group. Annual Cyber Threat Intelligence 2025. 5 March 2026. https://www.nccgroup.com/newsroom/ncc-group-annual-cyber-threat-intelligence-2025/. Leak-site monitoring for calendar 2025.

3. NCC Group. Monthly Threat Pulse: reviews of July, August and September 2026. 26 August, 23 September and 20 October 2026. https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-july-2026/, https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-august/ and https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-september/. Monthly leak-site counts.

4. Chainalysis. Crypto Ransomware: 2026 Crypto Crime Report. 26 February 2026. https://www.chainalysis.com/blog/crypto-ransomware-2026/. On-chain ransomware payments in 2025.

5. Coveware. Adverse cyber extortions are more common than commonly advised (Q2 2026). 29 July 2026. https://coveware.com/2026/07/adverse-cyber-extortions-are-more-common-than-commonly-advised/. Incident response caseload, Q2 2026, with the quarterly payment rate chart.

6. Coveware. Patch management goes from hard, to ludicrous in the agentic AI era (Q1 2026). 30 April 2026. https://coveware.com/2026/04/patch-management-goes-from-hard-to-ludicrous-in-the-agentic-ai-era/. Q1 2026 caseload.

7. Coveware. Why Zero-Day Downstream Mass Data Extortion Campaigns are Losing Their Bite (Q4 2025). 3 February 2026. https://coveware.com/2026/02/why-zero-day-downstream-mass-data-extortion-campaigns-are-losing-their-bite/. Q4 2025 caseload.

8. Coveware. Q3 2025, Q2 2025 and Q1 2025 quarterly reports. 2025. https://coveware.com/2025/10/insider-threats-loom-while-ransom-payment-rates-plummet/, https://coveware.com/2025/07/targeted-social-engineering-is-en-vogue-as-ransom-payment-sizes-increase/ and https://coveware.com/2025/05/the-organizational-structure-of-ransomware-threat-actor-groups-is-evolving-before-our-eyes/. Earlier quarterly payment data.

9. Sophos. The State of Ransomware 2026. 2026. https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf (landing page https://www.sophos.com/en-us/content/state-of-ransomware). Survey of 2,158 IT and security leaders in 17 countries, January to March 2026.

10. Sophos. 2026 Sophos Active Adversary Report. February 2026. https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report. 661 incident response and MDR cases, November 2024 to October 2025.

11. Verizon. 2026 Data Breach Investigations Report. May 2026. https://www.verizon.com/business/resources/T6a9/reports/2026-dbir-data-breach-investigations-report.pdf. Breaches from 1 November 2024 to 31 October 2025.

12. IBM. Cost of a Data Breach Report 2026. July 2026. https://www.ibm.com/reports/data-breach. Ponemon study of 602 breached organizations, March 2025 to February 2026.

13. IBM. Cost of a Data Breach 2025 (UK newsroom release). 2025. https://uk.newsroom.ibm.com/2025-cost-of-data-breach-UK. Attacker-disclosed ransomware and extortion breach cost, 2025 edition.

14. Mandiant (Google Cloud). M-Trends 2026. 23 March 2026. https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026. More than 500,000 hours of incident investigations in 2025.

15. FBI Internet Crime Complaint Center. 2025 Internet Crime Report. April 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf. Complaints filed in calendar 2025.

16. US Department of Health and Human Services, Office for Civil Rights. Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. Exported 25 October 2026. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf. Health data breaches affecting 500 or more individuals.

17. CISA. Known Exploited Vulnerabilities Catalog (JSON feed). Catalog version 2026.10.23, downloaded 25 October 2026. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. Vulnerabilities with confirmed exploitation and the known ransomware use flag.

18. CISA. #StopRansomware advisories, including AA26-293A (SafePay) and AA26-222A (Gunra). 2022 to 2026. https://www.cisa.gov/stopransomware/official-alerts-statements-cisa and https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a. Joint advisories on individual ransomware groups.

19. Europol. Internet Organised Crime Threat Assessment (IOCTA) 2026. May 2026. https://www.europol.europa.eu/cms/sites/default/files/documents/IOCTA-2026.pdf. EU cybercrime in 2025.

20. Europol. Takedown releases on Phobos and 8Base (11 February 2025), First VPN (21 May 2026) and AudiA6 (11 June 2026). https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-in-international-cybercrime-crackdown, https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown and https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline. Law enforcement actions.

21. ENISA. ENISA Threat Landscape 2025 (version 1.3). October 2025, revised September 2026. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025. 4,875 incidents, 1 July 2024 to 30 June 2025.

22. US Department of Justice. Justice Department Announces Coordinated Disruption Actions Against BlackSuit (Royal) Ransomware Operations. 11 August 2025. https://www.justice.gov/opa/pr/justice-department-announces-coordinated-disruption-actions-against-blacksuit-royal. Infrastructure takedown of 24 July 2025.

23. UK National Crime Agency. Operation Cronos releases. 20 February 2024 and 7 May 2024. https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group and https://www.nationalcrimeagency.gov.uk/news/lockbit-leader-unmasked-and-sanctioned. LockBit disruption and sanctions.

24. UK Department for Science, Innovation and Technology and Home Office. Cyber Security Breaches Survey 2025/2026. 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026. Survey of 2,112 UK businesses and 1,085 charities, August to December 2025.

25. UK National Cyber Security Centre. NCSC Annual Review 2025. October 2025. https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management. Incidents from 1 September 2024 to 31 August 2025.

26. Canadian Centre for Cyber Security. Ransomware Threat Outlook 2025-2027 and National Cyber Threat Assessment 2025-2026. October 2025 and October 2024. https://www.cyber.gc.ca/en/guidance/ransomware-threat-outlook-2025-2027 and https://www.cyber.gc.ca/en/guidance/national-cyber-threat-assessment-2025-2026. Canadian ransomware trends and judgements. Communications Security Establishment, CSE releases its 2025-2026 Annual Report, 29 June 2026, https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html.

27. Australian Signals Directorate. Annual Cyber Threat Report 2024-25. 14 October 2025. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025. Incidents responded to in FY2024-25 (read from the Internet Archive copy of September 2026).

28. Coalition. 2026 Cyber Claims Report. March 2026. https://www.coalitioninc.com/au/announcements/au-2026-cyber-claims-report and https://www.coalitioninc.com/en-gb/claims-report/2026. Claims from more than 100,000 policyholders in 2025.

29. Stingrai. The State of Penetration Testing 2026: An Analysis of 1,206 Verified Findings. 29 August 2026. https://www.stingrai.io/blog/state-of-penetration-testing-2026. 55 penetration tests, October 2024 to August 2026.

Talk to Stingrai

Ransomware reaches most organizations through stolen identities, unpatched edge devices and an internal network that was never tested from the inside. Stingrai's penetration testers can scope an internal and external network penetration test, an Active Directory assessment or an assumed-breach red team engagement, as a one-time test or a continuous program. Get a quote or book a discovery call.