15+ Shocking Ransomware Statistics [2026]: Trends + Facts

Research Summary: Ransomware continues to be a pervasive threat, affecting organizations of all sizes, from small businesses to large enterprises. As we move into 2026, the rise in ransomware incidents reflects a critical need for improved cybersecurity measures across industries.

In today’s digital landscape, it’s imperative for businesses to protect themselves against ransomware attacks. To illuminate this pressing issue, we have compiled a comprehensive list of ransomware statistics. According to our extensive research:

• Ransomware attacks occur every 11 seconds.

• In 2021, businesses incurred losses of $1.3 billion due to ransomware payouts and $159.4 billion from downtime.

• Ransomware incidents surged by 80% year-over-year between 2021-2022.

• The average ransomware attack costs $4.62 million.

For further insights, we have categorized the data as follows:
Frequency | Cost | Victim

Ransomware Frequency Statistics

The frequency of ransomware attacks has escalated significantly in recent years. Here are some key statistics that highlight the severity of this issue:

• There were approximately 623.3 million ransomware attacks globally in 2021.

  Though annual data for 2022 is still pending, the first half of 2022 alone recorded 236.1 million ransomware incidents.

  Year	Number of ransomware attacks (in millions)
  2016	638M
  2017	183.6M
  2018	206.4M
  2019	187.9M
  2020	340.6M
  2021	623.3M
  H1 2022	236.1M

• Approximately 71% of businesses fell victim to ransomware in 2022.

  This represents a significant increase from the 55.1% of businesses impacted in 2018, illustrating a 29% rise in just four years.

  Year	Share of businesses victimized by ransomware
  2018	55.1%
  2019	56.1%
  2020	64.2%
  2021	68.5%
  2022	71.0%

• 32% of ransomware attacks end with the victim paying the ransom.

  Almost one-third of victims opt to pay the ransom, although only 92% manage to recover their data, leaving many organizations in a precarious situation.

• 54% of ransomware incidents stem from phishing emails.

  Phishing remains the leading cause of ransomware attacks, followed by poor user practices (27%), insufficient cybersecurity training (26%), and weak passwords (21%).

  Cause of ransomware attack	Share of businesses
  Phishing emails	54%
  Poor user practices	27%
  Lack of cybersecurity training	26%
  Weak passwords	21%
  Open RDP preference	20%
  Clickbait	17%
  Malicious websites	14%
  Lost/stolen user credentials	10%

Ransomware Cost Statistics

Ransomware not only impacts a vast majority of businesses but also incurs substantial financial costs. Here are some critical insights regarding those costs:

• The average ransomware attack costs $4.62 million.

  This figure surpasses the average cost of a data breach in the US, which is $4.35 million, indicating ransomware attacks are particularly devastating.

• The highest ransom paid in a ransomware attack was approximately $40 million in 2021.

  CNA Financial reportedly paid $40 million, with other significant payments including Garmin ($10 million), CWT Global ($4.5 million), Colonial Pipeline ($4.4 million), and Brenntag ($4.4 million).

• Downtime from ransomware attacks costs an average of $8,662 per minute.

  This equates to nearly $520,000 per hour, and with an average downtime of nine days, the costs accumulate rapidly.

• The average ransom demand from attackers is $2.2 million.

  Cybercriminals are increasingly bold in their demands, yet typically only 15% of the total ransom amount is actually paid.

Ransomware Victim Statistics

While financial figures illustrate the impact of ransomware, the true stories of the victims reveal the broader ramifications of these attacks. These incidents can lead to the closure of small businesses and the bankruptcy of large corporations, ultimately affecting the livelihoods of numerous individuals. Here are the key facts:

• 10% of all data breaches are initiated by ransomware attacks.

  This figure has doubled from 2020 to 2021, partly due to the increased online dependency that emerged during the pandemic.

• The average downtime for ransomware attacks ranges from seven to 21 days.

  Specifically, the median downtime is nine days, which is already extremely costly for victims.

• The average victim recovers only 65% of their stolen data after paying the ransom.

  Even when attackers return data, which is rare, victims often do not receive all of their stolen information.

• 15% of IT professionals feel their organization is unprepared for a ransomware attack.

  Conversely, 85% believe their organization is at least somewhat prepared. However, 38% of staff report that their companies have not conducted any ransomware training.

• 61% of SMBs were targeted by cyberattacks in 2021.

  Despite many ransomware attackers focusing on large corporations for higher payouts, small to medium-sized businesses remain appealing targets due to their typically lower cybersecurity defenses.

Ransomware Statistics FAQ

1. What percentage of ransomware attacks are successful?

   Ransomware attacks have a success rate of approximately 32%, with victims opting to pay the ransom. This figure has seen a rapid increase year-over-year, with 58% of affected organizations paying ransoms in 2021, compared to only 34% in 2020.

   However, it’s crucial to note that typically only 15% of the full ransom is paid, which can significantly impact the financial outcomes for companies.

2. How often do ransomware attacks occur?

   Ransomware attacks occur every 11 seconds as of 2022. This marks an approximate 20% increase from 2019, when attacks were estimated to occur every 14 seconds.

   To put this into perspective, this equates to 5.45 ransomware attacks per minute, 327 per hour, and 7,848 per day in 2022.

3. Are ransomware attacks on the rise?

   Yes, ransomware attacks have surged, with an 80% increase year-over-year. The lingering effects of the COVID-19 pandemic have contributed to this escalation, as many companies transitioned to online operations in 2020.

   From 2020 to 2021 alone, the number of attacks jumped from 340.6 million to 623.3 million (an 83% increase).

4. What is the financial impact of the average ransomware attack?

   The average ransomware attack incurs costs of $4.62 million. This substantial financial loss can be compounded by downtime and other associated costs, such as the average downtime costing businesses $8,662 per minute.

   Some companies, like CNA Financial, have experienced losses exceeding $40 million due to ransomware incidents in 2021.

Conclusion

As we move deeper into 2026, ransomware remains a critical issue for organizations worldwide, with attacks occurring every 11 seconds and affecting 71% of businesses. The average financial loss per attack is a staggering $4.62 million, which can be particularly devastating for small to medium-sized enterprises.

Given the evolving landscape of cyber threats, it is essential for organizations to implement robust cybersecurity measures, including comprehensive employee training, vigilance against scam emails, and the adoption of strong password policies.

References

1. INFIMA – Every 11 Seconds

2. NetApp – Measuring the true cost of a ransomware attack

3. TechCrunch – Ransomware is a global problem that needs a global solution

4. Statista – Annual number of ransomware attacks worldwide from 2016 to first half 2022

5. Statista – Percentage of organizations victimized by ransomware attacks worldwide from 2018 to 2022

6. Statista – Phishing the Most Common Cause of Ransom Attacks

7. Heimdall – Ransomware Payouts in Review: Highest Payments, Trends & Stats

8. Bluvector – The True Cost of Ransomware Goes Beyond the Ransom Payment

9. ZDNet – Ransomware payments: Here’s how much falling victim will now cost you

10. LoughTec – Downtime: The Real Cost of Ransomware

11. Businesswire – ISACA Survey: IT Security and Risk Experts Share Ransomware Insights in the Aftermath of the Colonial Pipeline Attack

Author

Jack Flynn

Jack Flynn is a writer for Zippia. In his professional career he’s written over 100 research papers, articles and blog posts. Some of his most popular published works include his writing about economic terms and research into job classifications. Jack received his BS from Hampshire College.