Ransomware Attack Cost 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 3, 2026 | License: CC BY 4.0
Prices verified on October 2, 2026. Every ransom, recovery and market figure on this page was re-read against its primary source on that date. Ransom “prices” are not published by vendors — they are observed in victim surveys, incident-response caseloads and blockchain data, so this page reports them as medians, means and ranges with the basis stated for each.
The headline number: a ransomware attack that encrypts data costs the typical victim $375,000 to recover from — and $1.7 million on average — before a single dollar of ransom, according to Sophos’s State of Ransomware 2026 survey of 2,158 hit organizations. Victims that pay add a median ransom of $769,000. Axis Intelligence Research’s analysis of the same data finds that companies with $250–500 million in revenue pay the steepest ransom relative to their size: about 0.53% of revenue, roughly 2.6 times the burden on smaller firms.
Quick Answer
- Recovery cost (excluding ransom): median $375,000, mean $1,700,200 — up 11% year over year (Sophos State of Ransomware 2026, survey fielded Jan–Mar 2026).
- Ransom paid: median $769,000 in Sophos’s survey of mid-size and large organizations; median $150,000 and average $1,880,612 across Coveware by Veeam’s Q2 2026 incident caseload.
- Axis Intelligence Research estimate: a paying victim with under $50 million in revenue loses about $425,000, or roughly 1.7% of revenue, once the median ransom and median recovery bill are combined.
Key Findings
- According to Sophos’s State of Ransomware 2026, the median ransom demand fell to $698,000, down 65% in two years, while the median payment was $769,000.
- According to Sophos, the mean cost to recover from a ransomware attack, excluding ransom, rose 11% to $1,700,200 in 2026, while the median held at $375,000.
- Axis Intelligence Research finds that organizations with $250–500 million in revenue paid a median ransom equal to about 0.53% of revenue, the highest burden of any band in Sophos’s 2026 data.
- According to Coveware by Veeam, the Q2 2026 median ransom payment fell 50% to $150,000 while the average jumped 176% to $1,880,612, driven by a few large data-theft extortions.
- According to Chainalysis, total on-chain ransomware payments fell about 8% to $820 million in 2025 even as claimed attacks rose 50%.
What Does a Ransomware Attack Actually Cost? The Full Price Table
A ransomware bill has three layers, and most published “cost” figures only measure one of them. The ransom is what the attacker charges. Recovery is what the victim spends rebuilding — downtime, people time, devices, network, lost opportunity. The breach layer (notification, legal, regulatory, lost business) is what IBM measures. Mixing them is the most common error in coverage of this topic.
| Cost layer | Metric | Value | As of | Basis | Source |
|---|---|---|---|---|---|
| Recovery (excl. ransom) | Mean | $1,700,200 | 2026 report | Survey, 2,158 hit orgs, 100–5,000 employees, 17 countries | Sophos State of Ransomware 2026 |
| Recovery (excl. ransom) | Median | $375,000 | 2026 report | Same survey | Sophos |
| Recovery (excl. ransom) | Mean, prior year | $1,525,716 | 2025 report | Same survey series | Sophos |
| Ransom demand | Median | $698,000 | 2026 report | Orgs with encrypted data, excl. demands ≥$40M | Sophos |
| Ransom demand | Mean | $3,126,372 | 2026 report | Same | Sophos |
| Ransom payment | Median | $769,000 | 2026 report | 530 paying orgs that disclosed amount | Sophos |
| Ransom payment | Median | $150,000 | Q2 2026 | Incident-response caseload | Coveware by Veeam |
| Ransom payment | Average | $1,880,612 | Q2 2026 | Incident-response caseload | Coveware by Veeam |
| Ransom payment | Median (on-chain) | $59,556 | 2025 | Blockchain-traced payments | Chainalysis |
| All breaches (context) | Global average breach cost | $4.99M | 2026 report | 602 breached orgs, Mar 2025–Feb 2026 | IBM Cost of a Data Breach 2026 |
Three medians for the “same” ransom — $59,556, $150,000, $769,000 — are not a contradiction. They are three different populations. Chainalysis sees every traceable on-chain payment, including small-business and individual extortions. Coveware sees companies that hired a professional response firm. Sophos only surveys organizations with 100 to 5,000 employees. The bigger the floor on victim size, the higher the median. Quote the one that matches the company you’re pricing.
The spread between the recovery mean ($1.7M) and median ($375K) matters more than either. Axis Intelligence Research calculates the mean at 4.5 times the median ($1,700,200 ÷ $375,000), which means a small number of catastrophic recoveries drag the average up. Sophos’s own distribution shows 19% of victims spending $1–5 million on recovery and 20% spending $500,000–$1 million. Budgeting to the median is optimistic. Budgeting to the mean is closer to what a board should reserve for.
How Much Do Ransomware Gangs Demand by Company Revenue?
Ransom is priced like enterprise software: by what the buyer can afford. Sophos’s 2026 data broken down by revenue makes the pricing model visible. Attackers do reconnaissance on revenue before they name a number.
| Annual revenue | Median demand | Median payment | Median share of demand paid | Source |
|---|---|---|---|---|
| Under $50M | $140,000 | $50,000 | 95% | Sophos State of Ransomware 2026 |
| $50.1M–$250M | $214,000 | $305,000 | 100% | Sophos State of Ransomware 2026 |
| $250.1M–$500M | $1,368,000 | $2,000,000 | 100% | Sophos State of Ransomware 2026 |
| $500.1M–$1B | $590,250 | $500,000 | 83% | Sophos State of Ransomware 2026 |
| $1.1B–$5B | $2,280,000 | $1,290,000 | 83% | Sophos State of Ransomware 2026 |
| $5B+ | $5,700,000 | $5,700,000 | 83% | Sophos State of Ransomware 2026 |
Demand and payment medians come from different respondent subsets (organizations that disclosed demands vs. those that disclosed payments), which is why the payment median can exceed the demand median in a band. The “share paid” column comes from the 507 organizations that disclosed both.
Two things jump out. First, the line is not smooth: the $250–500M band faces a median demand more than twice that of the $500M–$1B band above it. Second, discounts start at $500 million. Every band above that line paid a median of 83% of the demand. The two bands between $50M and $500M paid 100%. Sophos also found that a quarter of victims in the $50–250M band paid more than the opening demand.
Here’s what actually happened in that middle tier: companies big enough to be worth a seven-figure demand, but not big enough to keep a retained negotiator, outside counsel and tested immutable backups on standby. They have the revenue to pay and no leverage to haggle.
The Axis Ransom Revenue Burden (RRB™): Who Pays the Most Relative to Size
Raw ransom figures flatter large companies — $5.7 million sounds worse than $50,000. Normalizing by revenue shows where the ransom actually hurts. Axis Intelligence Research built the Ransom Revenue Burden (RRB™) to do that.
Definition. The Ransom Revenue Burden (RRB™) is the median ransom payment in a revenue band, expressed as a percentage of that band’s revenue midpoint.
Formula. RRB = (median ransom payment ÷ revenue-band midpoint) × 100
Inputs. Median payments by revenue band from Sophos State of Ransomware 2026. Band midpoints are computed by Axis Intelligence Research: $25M for under-$50M, $150M, $375M, $750M and $3.05B for the closed bands. The open-ended $5B+ band uses its $5B floor, so its RRB is an upper bound.
| Revenue band | Median payment | Midpoint used | RRB™ | Source / method |
|---|---|---|---|---|
| Under $50M | $50,000 | $25M | 0.20% | Axis calculation on Sophos data |
| $50.1M–$250M | $305,000 | $150M | 0.20% | Axis calculation on Sophos data |
| $250.1M–$500M | $2,000,000 | $375M | 0.53% | Axis calculation on Sophos data |
| $500.1M–$1B | $500,000 | $750M | 0.07% | Axis calculation on Sophos data |
| $1.1B–$5B | $1,290,000 | $3.05B | 0.04% | Axis calculation on Sophos data |
| $5B+ | $5,700,000 | $5B (floor) | ≤0.11% | Axis calculation on Sophos data |
What the reading says. Axis Intelligence Research finds the $250–500M revenue band carries an RRB of 0.53% — about 2.6 times the 0.20% burden on companies below $250M, and about eight times the 0.07% burden one band up. Above $500 million, the burden collapses. Below $250 million, it is flat. The mid-market is where ransom is priced most aggressively against the victim’s ability to absorb it.
This is the inaugural RRB reading and serves as the baseline. It will be recomputed from each annual Sophos release, and readings carry the survey year they’re built on.
What RRB does not capture. RRB measures the ransom only, not recovery, and the under-$50M midpoint is an assumption: a $5M company paying $50,000 bears ten times the burden shown. It is best read as a comparison between bands, not a precise percentage for any single company.
Fully Loaded: What a Paying Victim Actually Spends
The ransom is not the bill. A paying victim still has to rebuild. Axis Intelligence Research combined Sophos’s band-level median payments with Sophos’s global median recovery cost to estimate a typical fully loaded bill for a victim that pays.
Formula. Estimated paying-victim bill = median ransom payment (band) + median recovery cost ($375,000, all sizes)
| Revenue band | Median ransom | + Median recovery | = Axis estimated bill | As % of band midpoint |
|---|---|---|---|---|
| Under $50M | $50,000 | $375,000 | $425,000 | ~1.7% |
| $50.1M–$250M | $305,000 | $375,000 | $680,000 | ~0.45% |
| $250.1M–$500M | $2,000,000 | $375,000 | $2,375,000 | ~0.63% |
| $500.1M–$1B | $500,000 | $375,000 | $875,000 | ~0.12% |
| $1.1B–$5B | $1,290,000 | $375,000 | $1,665,000 | ~0.05% |
| $5B+ | $5,700,000 | $375,000 | $6,075,000 | ≤0.12% |
These are estimates, labeled as such. Sophos publishes recovery cost globally, not by revenue band, so the same $375,000 median is applied to every row — almost certainly understating recovery at large enterprises and overstating it at the smallest. Adding two medians also doesn’t produce a true median of the sum. What the table does show reliably is the shape: for small companies, recovery is the bigger number. A sub-$50M company’s recovery median is 7.5 times its median ransom. That ratio flips above $250 million, where the ransom becomes the larger line item.
So the question “should we pay?” is the wrong first question for a small company. The ransom is a fraction of the bill either way. Backups that actually restore — Sophos found 66% of victims with encrypted data used backups to recover in 2026, up from 54% — are what moves the larger number.
Why the FBI Reports Only $32 Million in Ransomware Losses
The FBI’s Internet Crime Complaint Center received 3,611 ransomware complaints in 2025 reporting $32,320,105 in losses, up from $12,473,156 in 2024, according to the IC3 2025 Annual Report. Axis Intelligence Research calculates that works out to about $8,950 per complaint — a figure that sits two orders of magnitude below every survey on this page.
That gap is not a sign that ransomware is cheap. The FBI states plainly that its ransomware loss figure excludes lost business, time, wages, files, equipment and third-party remediation, and that many entities report no loss at all. IC3 numbers are a complaint count with partial dollar fields. Never quote $32 million as “the cost of ransomware in the U.S.” — it measures what was typed into a form.
What IC3 data does show well is who gets hit. Healthcare and public health filed 460 ransomware complaints in 2025, more than any other critical-infrastructure sector. Among non-critical businesses, legal services made up 18% of ransomware complaints and contracting services 17%. Coveware’s Q2 2026 caseload points the same way: Silent Ransom (Luna Moth) extracted outsized payments from law firms by threatening to publish privileged client files.
What Moves the Price of a Ransomware Attack?
Revenue, first. The Sophos revenue table above is the clearest evidence: median demands climb from about $140,000 under $50M to $5.7 million above $5 billion.
Where the attacker got in. Sophos found 59% of demands were $1 million or more when the attack began with an exploited firewall vulnerability, versus 48% of all demands. A compromised firewall hands over the whole network, and the price reflects it. Identity is now the dominant entry point overall: 79% of attacks in Sophos’s 2026 data started with an identity-based approach, and malicious email (26%) plus phishing (24%) overtook exploited vulnerabilities (18%) as root causes.
Whether data was stolen as well as encrypted. 16% of attacks in Sophos’s 2026 data both encrypted and stole data, giving the attacker two levers. But data-theft-only extortion is losing its grip on payers: Coveware reports the payment rate for exfiltration-only cases fell to a historic low of 15% in Q2 2026. IBM’s 2026 study found attackers increasingly lean on reputation (41%), employee data (35%) and intellectual property (31%) as pressure points.
Sector. Local and state government paid in 72% of encryption cases in Sophos’s 2026 survey; retail paid in 32%. A city that can’t issue permits or run 911 dispatch negotiates from a weaker position than a retailer that can take orders on paper for a week.
How fast you restore. Sophos reports 55% of victims fully recovered within a week, 83% within a month. Every additional week of downtime is recovery cost, and recovery cost — not ransom — is the bigger number for most companies.
What Does It Cost the Attacker? The Other Side of the Price Tag
The economics are lopsided, and the numbers show by how much. Chainalysis, citing Darkweb IQ, reports the average price of initial access to a victim network fell from about $1,427 in Q1 2023 to $439 in Q1 2026. Chainalysis also estimates initial access brokers received at least $14 million on-chain in 2025, against roughly $820 million flowing to ransomware actors — a ratio Chainalysis puts at nearly 58 to 1.
Set side by side — not merged, since one is a dark-market listing price and the other a victim survey — a $439 foothold against a $375,000 median recovery bill is the whole business model in two numbers. Validated, domain-level enterprise access still sells at a premium, per the same Darkweb IQ data, so the cheapest access is not what lands seven-figure ransoms.
Is Ransomware Getting Cheaper or More Expensive in 2026?
Both, depending on which line you read. The ransom side is deflating: Sophos’s median demand has dropped from $2 million (2024 report) to $1.32 million (2025) to $698,000 (2026). Chainalysis’s on-chain total fell about 8% in 2025, and it estimates the share of victims paying may have hit an all-time low of 28%. Coveware’s overall payment rate reached a record low in Q2 2026.
The recovery side is not. Sophos’s mean recovery cost rose 11% this year, and the encryption success rate climbed back to 56% from 50%. IBM’s 2026 study shows ransomware was reported in 39% of breaches, up from 34%, and the global average breach reached a record $4.99 million.
The read: victims have learned to refuse. Attackers have learned to hit more targets. The ransom is becoming a smaller share of a ransomware event that is not getting smaller.
Does Cyber Insurance Cost More Because of Ransomware?
Not right now. Marsh’s Global Insurance Market Index shows cyber insurance rates fell 4% globally in Q2 2026, the twelfth consecutive quarterly decline, with U.S. rates down 2%, according to Marsh’s Q2 2026 release. The pace of reductions is slowing, and Marsh notes underwriters increasingly ask about AI exposure and vendor risk.
Falling premiums with rising recovery costs is a combination worth watching. Buyers with demonstrable controls — tested backups, phishing-resistant MFA on admin accounts, an incident-response retainer — are the ones Marsh describes as using this market to raise limits rather than just cut spend. For the full premium and claims picture, see our cyber insurance statistics.
How to Use These Numbers When You Budget
If you’re under $250M in revenue: plan around recovery, not ransom. The Axis estimate puts a paying sub-$50M victim at roughly $425,000 all-in, and almost 90% of that is the rebuild. A restore you’ve actually tested is worth more than any negotiation playbook.
If you’re between $250M and $500M: you’re in the band with the highest RRB™ and the weakest negotiating record (100% median share paid). This is where a pre-negotiated incident-response retainer and pre-approved decision authority pay for themselves.
If you’re above $500M: your ransom is large in dollars but small against revenue, and your band negotiates a median 17% discount. The exposure that scales is the breach layer — regulatory, litigation, lost business — which is why IBM’s figures run higher than ransom data.
For any board deck: cite the recovery mean ($1.7M) as the reserve number and the median ($375K) as the typical case. Showing both is more honest than either alone, and it’s the question an underwriter will ask.
FAQ: Ransomware Pricing Questions Security and Finance Teams Ask
How much do ransomware attackers demand from a company with under $50 million in revenue?
About $140,000 at the median, according to Sophos’s State of Ransomware 2026. Paying victims in that band paid a median of $50,000, or 95% of the demand where both figures were disclosed.
Why does one report say the median ransom is $769,000 and another says $150,000?
They measure different victims. Sophos surveys organizations with 100–5,000 employees ($769,000 median paid). Coveware by Veeam reports its own incident caseload ($150,000 median in Q2 2026). Chainalysis tracks all traceable on-chain payments ($59,556 median in 2025).
Is recovering from ransomware more expensive than paying the ransom?
For small companies, yes. Sophos puts median recovery at $375,000 excluding ransom. For organizations under $50 million in revenue, Axis Intelligence Research calculates that is 7.5 times the band’s $50,000 median ransom.
Do companies that negotiate with ransomware gangs actually pay less?
Larger ones do. Sophos found organizations above $500 million in revenue paid a median 83% of the demand, while the $50–500 million bands paid 100%. Overall, 51% of payers paid less than the opening demand.
What is the Ransom Revenue Burden (RRB™)?
RRB™ is an Axis Intelligence Research metric: the median ransom payment in a revenue band divided by the band’s revenue midpoint. The 2026 baseline peaks at 0.53% for companies with $250–500 million in revenue.
How much does it cost an attacker to break in?
About $439 on average for initial network access in Q1 2026, down from roughly $1,427 in Q1 2023, according to Darkweb IQ data published by Chainalysis. Premium domain-level access sells for more.
Why are FBI ransomware loss figures so low?
The IC3 recorded $32.3 million across 3,611 ransomware complaints in 2025, but the FBI says the figure excludes downtime, lost business and remediation, and many victims report no loss. It is a floor, not a cost estimate.
Are cyber insurance premiums going up because of ransomware?
No. Marsh reports global cyber insurance rates fell 4% in Q2 2026, the twelfth straight quarterly decline, and U.S. rates fell 2%.
Methodology
Scope. This page prices ransomware events — ransom demanded, ransom paid, and recovery — not the broader data breach. All figures are in U.S. dollars.
Sources. Every figure was retrieved from a primary publisher and re-verified on October 2, 2026: Sophos State of Ransomware 2026 (survey by Vanson Bourne, Q1 2026, 2,158 respondents across 17 countries, organizations of 100–5,000 employees); Coveware by Veeam Q2 2026 cyber-extortion report (incident-response caseload, published July 29, 2026); Chainalysis 2026 Crypto Crime Report ransomware chapter (on-chain data, published February 26, 2026); IBM Cost of a Data Breach Report 2026 (Ponemon Institute, 602 organizations, press release July 29, 2026); FBI IC3 2025 Annual Report; Marsh Global Insurance Market Index Q2 2026 (July 23, 2026).
Axis calculations. (1) Ransom Revenue Burden (RRB™) = median band payment ÷ band revenue midpoint × 100, midpoints as stated in the RRB section. (2) Estimated paying-victim bill = band median payment + global median recovery cost ($375,000). (3) Recovery skew = mean recovery ÷ median recovery. (4) IC3 loss per complaint = $32,320,105 ÷ 3,611. All inputs and outputs are in the downloadable CSV with axis_calculated = yes and a method note.
What we did not merge. Survey, caseload and on-chain medians are reported side by side and never averaged, because their populations differ. The initial-access price and the recovery bill are presented next to each other for scale, not combined into a ratio.
Related Axis research. For attack volume, groups and sector exposure, see our ransomware statistics. For breach costs across all attack types, see cybersecurity statistics and the live data breach tracker. Sector detail: healthcare cybersecurity statistics. Entry-point data: credential attack statistics. U.S. complaint data: cybercrime statistics.
Download the Dataset
ransomware-attack-cost.csv — every figure on this page with source organization, document, URL, retrieval date and calculation notes. Licensed CC BY 4.0.
Cite This Page
- APA: Axis Intelligence Research & Chen, M. (2026, October 3). How much does a ransomware attack cost in 2026? The ransom price list by company size. Axis Intelligence. https://axis-intelligence.com/ransomware-attack-cost/
- MLA: Axis Intelligence Research, and Marcus Chen. “How Much Does a Ransomware Attack Cost in 2026? The Ransom Price List by Company Size.” Axis Intelligence, 3 Oct. 2026, axis-intelligence.com/ransomware-attack-cost/.
- Chicago: Axis Intelligence Research and Marcus Chen. “How Much Does a Ransomware Attack Cost in 2026? The Ransom Price List by Company Size.” Axis Intelligence, October 3, 2026. https://axis-intelligence.com/ransomware-attack-cost/.
Disclosure: this page may contain affiliate or lead-generation links to security vendors. No commercial relationship influences any figure, ordering or conclusion.