Ransomware continues to evolve — and so must our defenses. The State of Ransomware 2025 report from Sophos presents one of the most comprehensive views yet into how organisations around the world are being impacted by ransomware attacks. Based on an independent survey of 3,400 IT and cybersecurity leaders across 17 countries, the report explores how attacks are evolving, the operational weaknesses adversaries exploit, and the human and financial tolls that follow. Whether you’re building a cybersecurity strategy or assessing risk, this year’s findings offer crucial, real-world insights to guide your response.
Key Findings from the State of Ransomware 2025
The 2025 report reveals important shifts in how ransomware is impacting organisations, from how attacks begin to how companies respond. Here are the standout insights:
Why Organizations Fall Victim
- Exploited vulnerabilities remain the most common root cause (32% of attacks).
- Lack of cybersecurity expertise was the top operational failure (40.2%), followed closely by unknown security gaps (40.1%) and staffing shortages (39.4%)
What Happens to the Data
- Only 50% of ransomware attacks resulted in data encryption, the lowest level in six years.
- 28% of encrypted-data cases also involved data theft, showing growing use of double extortion tactics
Ransom Demands and Payments
- The median ransom demand dropped 34% to $1.32M.
- The median payment fell 50% to $1M, driven by fewer multi-million-dollar settlements.
- 53% of organisations negotiated the payment down, while 18% paid more than the initial demand
Cost and Recovery
- The average cost to recover (excluding ransom) is down 44% year-over-year, now at $1.53M.
- 53% of organisations fully recovered within a week, a significant improvement from 35% in 2024
Human Impact on IT/Cybersecurity Teams
- 41% of affected teams reported increased anxiety or stress.
- 34% experienced guilt, and 31% reported staff absence due to mental health issues.
- In 25% of cases, team leadership was replaced following the incident
Get the complete State of Ransomware 2025 report to dive deeper into the data, trends, and expert recommendations. Understand how ransomware threats are evolving — and how to better defend your organisation.
