Ransomware Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 28, 2026 | License: CC BY 4.0
Ransomware crews posted 2,760 victims on leak sites in the third quarter of 2026, the highest quarterly count GuidePoint has recorded and 75% more than a year earlier. The money is moving the other way: Axis Intelligence Research’s Ransom Yield Index shows gangs collected roughly 39% less per claimed victim in 2025 than in 2024.
Quick Answer
Ransomware volume is at a record and payouts are shrinking. GuidePoint counted 7,174 publicly posted victims from January to September 2026, already 95% of its full-year 2025 total of 7,515. Chainalysis tracked $820 million in on-chain ransom payments in 2025, down 8% from $892 million, while claimed victims rose 50%. Axis Intelligence Research’s Ransom Yield Index (RYI) puts 2025 at 61.3 against a 2024 base of 100.
Key Findings
- Axis Intelligence Research finds ransomware groups earned about 39% less per claimed victim in 2025 than in 2024: the Ransom Yield Index (RYI) reads 61.3, from Chainalysis’s $820 million in 2025 on-chain payments against a 50% rise in leak-site claims.
- Axis Intelligence Research calculates that 2026 had already reached 95.5% of 2025’s full-year ransomware victim count by September 30, 2026: 7,174 publicly posted victims through Q3 2026 against 7,515 for all of 2025, per GuidePoint’s GRIT reports.
- Ransomware leak sites averaged 26.3 newly posted victims per day in the first nine months of 2026, an Axis Intelligence Research calculation from GuidePoint data, up from 20.6 per day across 2025.
- How many victims pay depends on who counts: 15% of data-theft-only cases paid in Coveware’s Q2 2026 caseload, 28% of ransoms were paid in 2025 per Chainalysis, and 48% of organizations whose data was encrypted paid in Sophos’s 2026 survey.
- The average ransom payment in Coveware cases was 12.5 times the median in Q2 2026 ($1,880,612 versus $150,000), an Axis Intelligence Research calculation showing that a handful of large payers now drive the averages.
How Many Ransomware Attacks Are There in 2026?
GuidePoint’s Research and Intelligence Team (GRIT) recorded 2,760 publicly posted ransomware victims in Q3 2026, a record quarter, up 21% from Q2 2026 and 75% from Q3 2025. These are victims named on data leak sites, the extortion blogs where ransomware groups publish organizations that have not paid, or have not paid fast enough.
A leak-site count is a floor, not a census. Victims who pay quickly rarely appear, and some groups repost old or borrowed victims. It is still the only volume measure published every quarter on a consistent method, which is why it is the series this page tracks.
Ransomware victims by quarter, 2025–2026 (GuidePoint GRIT)
| Quarter | Publicly posted victims | Change vs same quarter prior year | Source |
|---|---|---|---|
| Q1 2025 | 2,063 | — | GuidePoint GRIT Q1 2025 release |
| Q2 2025 | 1,591 | — | GuidePoint GRIT Q2 2026 report |
| Q3 2025 | 1,576 | — | GuidePoint GRIT Q3 2025 report |
| Q4 2025 | 2,287 | — | GuidePoint GRIT 2026 annual report release |
| Full year 2025 | 7,515 | +58% vs 2024 | GuidePoint GRIT 2026 annual report |
| Q1 2026 | 2,135 | +3.5% (Axis calculation) | GuidePoint GRIT Q2 2026 report |
| Q2 2026 | 2,279 | +43% | GuidePoint GRIT Q2 2026 release |
| Q3 2026 | 2,760 | +75% | GuidePoint GRIT Q3 2026 report |
The four 2025 quarters as first published sum to 7,517, two more than GuidePoint’s revised annual total of 7,515. Q1 2025 includes a Cl0p mass-exploitation campaign; GuidePoint’s Q3 2025 report shows 1,715 for that quarter excluding Cl0p.
Where 2026 is heading: the Axis pace calculation
Axis Intelligence Research added GuidePoint’s three published 2026 quarters (2,135 + 2,279 + 2,760 = 7,174) and compared them with the same nine months of 2025 (2,063 + 1,591 + 1,576 = 5,230). The 2026 year-to-date count is 37.2% higher. Divided over 273 days, it equals 26.3 posted victims per day, against the 20.6 per day GuidePoint reported for 2025.
Three scenarios for the full year, each an Axis Intelligence Research estimate rather than a forecast:
| Q4 2026 assumption | Full-year 2026 victims | Change vs 2025 (7,515) |
|---|---|---|
| Q4 2026 equals Q4 2025 (2,287) | 9,461 | +25.9% |
| Q4 2026 equals Q3 2026 (2,760) | 9,934 | +32.2% |
| Q4 2026 grows at the year-to-date rate (+37.2%) | 10,311 | +37.2% |
Even the flattest scenario puts 2026 roughly a quarter above 2025, which GuidePoint itself called the most active year it had recorded.
Where the victims are
The United States is still the most targeted country, but its share is shrinking as crews spread out. GuidePoint attributed 55% of 2025 leak-site victims to the US; in Q2 2026 the US share fell to 40%, which GuidePoint called a historic low, before edging back to 42% in Q3 2026.
| Country | Share of Q2 2026 leak-site victims |
|---|---|
| United States | 40% |
| Germany | 5% |
| Canada | 5% |
| United Kingdom | 4% |
| France | 3% |
| Italy | 3% |
| Spain | 3% |
| Brazil | 2% |
| India | 2% |
| Australia | 2% |
| All other countries | 32% |
Source: GuidePoint GRIT Q2 2026 report, p. 5. Victims came from 108 countries in Q2 2026, up from 84 in Q2 2025; GuidePoint counted 115 countries in Q3 2026.
Two trackers, two numbers
Check Point Research counted 2,139 leak-site victims in Q2 2026, up 33% year over year. GuidePoint counted 2,279 for the same quarter. The 140-victim gap (6.5%) is definitional: each firm scrapes a different set of leak sites and de-duplicates reposts differently. We do not average them. Both agree on direction and on the size of the jump.
Marcus Chen: Look at the group count before the victim count. Check Point saw active groups go from 71 to 93 in one quarter; GuidePoint saw 112 in Q3. Volume used to mean a few big brands working hard. Now it means more small crews, many reusing leaked builders, each posting a few dozen names. That spreads the noise and makes attribution slower.
Are Ransomware Gangs Making Less Money? The Ransom Yield Index (RYI)
Yes, per victim. Chainalysis tracked more than $820 million in on-chain ransomware payments in 2025, 8% below its revised 2024 estimate of $892 million. Over the same period, claimed ransomware victims on leak sites rose 50%, according to eCrime.ch data cited by Chainalysis. Chainalysis describes 2025 as the second consecutive year of stagnating payments.
The Ransom Yield Index (RYI) is an Axis Intelligence Research metric that turns those two series into one number: how much on-chain ransom revenue the ecosystem collects per publicly claimed victim, indexed to 2024 = 100.
How the RYI is calculated
RYI(year) = 100 × [Payments(year) ÷ Payments(2024)] ÷ [Claimed victims(year) ÷ Claimed victims(2024)]
- Payments: Chainalysis on-chain ransomware revenue (2024 revised: $892 million; 2025: $820 million).
- Claimed victims: year-over-year change in leak-site claims, as reported by Chainalysis (+50%). GuidePoint’s independent count (+58%) is used as a cross-check.
2025 reading: 100 × (820 ÷ 892) ÷ 1.50 = 61.3. This is the baseline reading of a new series; 2024 is the base year.
| RYI input set | Payments 2025 | Victim growth | RYI 2025 | Change in yield per claimed victim |
|---|---|---|---|---|
| Headline (Chainalysis victims) | $820M | +50% | 61.3 | −38.7% |
| Cross-check (GuidePoint victims) | $820M | +58% | 58.2 | −41.8% |
| Revision test, Chainalysis victims | $900M | +50% | 67.3 | −32.7% |
| Revision test, GuidePoint victims | $900M | +58% | 63.9 | −36.1% |
Chainalysis expects its 2025 total to approach or exceed $900 million as more payments are attributed, so the revision rows test that case. Calculations by Axis Intelligence Research.
Every input combination lands between 58 and 68. Even if Chainalysis’s 2025 total rises to $900 million, the ecosystem earned at least a third less per publicly named victim than a year earlier.
In dollar terms, $820 million across GuidePoint’s 7,515 posted victims equals about $109,000 of on-chain ransom revenue per publicly named victim in 2025. That figure is a ratio of two totals, not an average ransom: most named victims paid nothing, and many payers were never named.
Marcus Chen: The RYI explains the behavior in the rest of this page. When yield per victim drops by a third, a crew has two moves: hit more targets, or hit fewer, bigger ones harder. 2026 shows both. Leak-site volume is at a record, and Coveware’s average payment spiked on a few law-firm extortions while the median halved. The cheap end of the market is spraying; the expensive end is hunting.
What else Chainalysis measured in 2025
- The median on-chain ransom payment rose 368%, from $12,738 in 2024 to $59,556 in 2025.
- Initial access brokers, who sell footholds into victim networks, received at least $14 million on-chain in 2025; total ransomware payments were nearly 58 times that.
- Darkweb IQ data published in the same report shows the average price of victim access fell from about $1,427 in Q1 2023 to $439 in Q1 2026.
- Chainalysis found that spikes in access-broker inflows typically precede increases in ransomware payments and leak-site posts by roughly 30 days.
What Percentage of Ransomware Victims Pay the Ransom?
Between 15% and 48% in 2025–2026, depending on the denominator. Each source counts a different population, so the figures are not interchangeable. The ladder below runs from the narrowest case (data stolen, nothing encrypted) to the widest (data encrypted).
| Population measured | Share that paid | Period | Source |
|---|---|---|---|
| Data-exfiltration-only cases (no encryption) | 15% | Q2 2026 | Coveware |
| All Coveware cases, every impact type | ~20% | Q4 2025 | Coveware |
| GuidePoint incident-response cases | just under 21% (from 50%) | Q3 2026 | GuidePoint GRIT |
| All Coveware cases, every impact type | 23% | Q1 2026 | Coveware |
| Ransoms paid, ecosystem-wide estimate | 28% (potential all-time low) | 2025 | Chainalysis |
| Ransomware victims in breach dataset | 31% (69% did not pay) | Nov 2024–Oct 2025 | Verizon DBIR 2026 |
| Organizations whose data was encrypted | 48% | 12 months to Q1 2026 | Sophos |
The pattern is consistent across all seven rows: the further an attack gets toward encryption and operational outage, the more likely the victim pays. When only data is stolen and systems keep running, most victims now refuse.
Coveware also warns that payment does not buy deletion: the February 2024 takedown of LockBit (Operation Cronos) showed the group had kept victims’ data after payments.
How Much Is the Average Ransom Payment in 2026?
The answer depends on whether you want the mean or the median, and the gap between them is now the story.
Coveware ransom payments by quarter
| Quarter | Average payment | Median payment | Average ÷ median (Axis calculation) |
|---|---|---|---|
| Q3 2025 | $376,941 | $140,000 | 2.7× |
| Q4 2025 | $591,988 | $325,000 | 1.8× |
| Q1 2026 | $680,081 | $300,750 | 2.3× |
| Q2 2026 | $1,880,612 | $150,000 | 12.5× |
Sources: Coveware quarterly reports (Q3 2025, Q4 2025, Q1 2026, Q2 2026). Coveware attributes the Q2 2026 spike to a few large payments in data-extortion cases, led by the Silent Ransom group’s campaign against law firms.
A 12.5× skew means the “average ransom” headline describes almost nobody. The median Coveware client paid $150,000 in Q2 2026, half the Q1 figure.
Other 2026 ransom benchmarks
| Metric | Value | Source |
|---|---|---|
| Median ransom paid, breach dataset | $139,875 (from $150,000) | Verizon DBIR 2026 |
| Median ransom demand, encrypted victims | $698,000 (from $1.32M in 2025 report) | Sophos State of Ransomware 2026 |
| Mean ransom demand, encrypted victims | $3,126,372 | Sophos State of Ransomware 2026 |
| Median ransom payment | $769,000 (from $1M in 2025 report) | Sophos State of Ransomware 2026 |
| Payers who paid less than the demand | 51% | Sophos State of Ransomware 2026 |
| Median demand, organizations under $50M revenue | $140,000 | Sophos State of Ransomware 2026 |
| Median demand, organizations over $5B revenue | $5,700,000 | Sophos State of Ransomware 2026 |
| Highest national median demand | United Kingdom, $2.5M | Sophos State of Ransomware 2026 |
Sophos surveys organizations with 100 to 5,000 employees, which is why its median sits far above Verizon’s and Chainalysis’s. For band-by-band ransom prices and what a paying victim spends in total, see our ransomware attack cost benchmark.
How Do Ransomware Attacks Start in 2026?
Through identity, mostly. In Sophos’s 2026 survey, 79% of ransomware attacks started with an identity-based approach, and two-thirds of victims (67%) said the ransomware incident was the same event as their most significant identity attack.
Root cause of ransomware attacks (Sophos)
| Root cause | 2025 report | 2026 report |
|---|---|---|
| Malicious email | — | 26% |
| Phishing | — | 24% |
| Compromised credentials | — | 23% |
| Exploited vulnerability | 32% | 18% |
| Brute force | — | 6% |
Source: Sophos State of Ransomware 2026 report, survey of 2,158 IT and security leaders in 17 countries, fielded January–March 2026. Exploited vulnerabilities, the top root cause in the 2025 report at 32%, fell 14 points.
MFA alone is not the answer the slide decks promise. Among victims breached through compromised credentials, 97% had multi-factor authentication (MFA) enabled in some form. The gaps were where it was missing: VPNs, firewall admin consoles, legacy apps.
Stolen credentials usually surface before the attack does. Verizon’s 2026 DBIR matched ransomware victims against infostealer logs and credential leaks: only 27% had no such event in the prior year, and among those that did, half had one within 95 days of being posted as a victim (DBIR 2026, p. 44). A credential appearing in an infostealer log is an early warning with a window of roughly three months.
Where the intrusion happens
| Entry location (attacks via vulnerabilities, credentials or brute force) | Share |
|---|---|
| Exposed applications and systems | 38% |
| User devices | 30% |
| Firewalls | 21% |
| VPNs | 8% |
| IoT devices | 3% |
Source: Sophos State of Ransomware 2026 (n=1,022). When the attack began with an exploited firewall vulnerability, 59% of ransom demands were $1 million or more, against 48% across all attacks.
The patching picture
Sophos’s survey and Verizon’s breach data disagree on vulnerabilities, and the disagreement is informative. Verizon’s 2026 Data Breach Investigations Report (DBIR) found exploitation of vulnerabilities was the most common initial access vector across all breaches, at 31%. Only 26% of vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, down from 38%, and the median time to full resolution rose to 43 days from 32. Sophos asks victims what they believe happened; Verizon codes forensic case data across all breach types. Both can be true: email is the most common way into mid-sized organizations, while unpatched edge devices drive a growing share of the largest breaches. Track the catalog itself on our KEV tracker.
Marcus Chen: Coveware’s Q2 2026 casework reads like a help-desk incident log: password resets, MFA resets, OAuth grants, vendor sessions. The attacker logs in; nothing gets broken. If your IR plan starts with “isolate the infected host,” rewrite the first page for “revoke the token.”
Which Industries Are Hit Hardest by Ransomware?
Manufacturing leads by victim count, healthcare leads by reported complaints to the FBI, and local government is the most likely to pay.
By leak-site victims and caseload
| Measure | Leading sector | Value | Source |
|---|---|---|---|
| Share of 2025 leak-site victims | Manufacturing | 14% (Technology 9%, Retail/Wholesale 7%) | GuidePoint GRIT 2026 annual |
| Share of Q2 2026 leak-site victims | Manufacturing | nearly 15% | GuidePoint GRIT Q2 2026 |
| Share of Coveware cases, Q2 2026 | Software services | 17.2% (Healthcare 14.1%, Professional services 13.1%, Financial 9.1%, Materials 9.1%) | Coveware Q2 2026 |
| Ransomware complaints from critical infrastructure, 2025 | Healthcare and Public Health | 460 complaints | FBI IC3 2025 |
The FBI figure is the owned value on our healthcare cybersecurity statistics page. Across all sectors, the FBI’s Internet Crime Complaint Center (IC3) received 3,611 ransomware complaints in 2025, up from 3,156 in 2024 and 2,825 in 2023. More than 1,400 came from outside the 16 critical infrastructure sectors, led by legal services (18%) and contracting (17%).
Small businesses
Of the ransomware cases in Verizon’s 2026 DBIR where victim size was known, about 96% hit small and medium-sized businesses (p. 98). In SMB breaches, compromised credentials (38%) and unpatched edge-device vulnerabilities (29%) were the openings Verizon highlights. These crews cast wide nets; the victim’s industry or revenue matters less than whether a door was left open.
Share of encrypted victims that paid, by sector (Sophos 2026)
| Sector | Paid the ransom |
|---|---|
| Local/state government | 72% |
| Media, leisure and entertainment | 64% |
| Central/federal government | 54% |
| Distribution and transport | 53% |
| Higher education | 51% |
| Financial services | 50% |
| Energy, oil/gas and utilities | 47% |
| Healthcare | 45% |
| Manufacturing | 43% |
| Lower education | 43% |
| Business and professional services | 42% |
| IT, technology and telecoms | 40% |
| Construction and property | 39% |
| Retail | 32% |
Source: Sophos State of Ransomware 2026, p. 21; base: organizations that had data encrypted, n=1,214.
Local government paying at more than twice the rate of retail says more about recovery options than about willingness. A council that cannot pay benefits or issue permits has a hard deadline; a retailer can sell from another channel. That is also why the UK chose the public sector for its proposed payment ban (see the 2027 section).
Which Ransomware Groups Are Most Active in 2026?
The Gentlemen and Qilin, which together claim roughly one in four posted victims.
| Group | Q3 2026 share of victims (GuidePoint) | Q2 2026 victims (Check Point) | Q2 2026 share of Coveware cases | FBI IC3 2025 top-10 rank |
|---|---|---|---|---|
| The Gentlemen | 12.9% | 269 | 8% | — |
| Qilin | 12.6% | 279 | — | 2 |
| Akira | — | — | 9% | 1 |
| DragonForce | — | — | 4% | 8 |
| ShinyHunters | — | — | 12% | — |
| “Lone wolf” actors (unaffiliated) | — | — | 17% | — |
Sources: GuidePoint GRIT Q3 2026; Check Point Research Q2 2026; Coveware Q2 2026; FBI IC3 2025 Annual Report. A dash means the source does not report that group for that period.
The FBI’s full 2025 top 10 by complaints, in order: Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa. Together they accounted for 56.8% of ransomware complaints. IC3 identified 63 new ransomware variants in 2025, an average of 5.25 per month.
What one top group actually earns
GuidePoint’s Q2 2026 report, using TRM Labs payment data, shows the yield squeeze at the level of a single group. Qilin observed 65 payments totaling $26.8 million in H1 2025 against 326 claimed victims; in H1 2026 it observed 43 payments totaling $19.9 million against 659 claimed victims. Axis Intelligence Research calculates that Qilin’s revenue per claimed victim fell 63%, from about $82,200 to $30,200, and that the share of claimed victims matched to a payment fell from 19.9% to 6.5%. Akira’s observed payments fell from 78 ($42 million) to 39 ($8.7 million) over the same period, with the average payment down from $413,000 to $223,000.
The lists disagree because they measure different things. Leak-site trackers count names posted; Coveware counts cases its negotiators handled; IC3 counts US complaints. ShinyHunters ranks second in Coveware’s caseload but is absent from the leak-site leaderboards, a reminder that data-theft crews working against enterprise SaaS platforms do not always show up where trackers look.
Marcus Chen: Check Point reported that The Gentlemen used AI coding assistants to build its management panel in about three days. Tooling that once took a crew months now takes a long weekend, which is why a group can go from unknown to number one in under a year. That is the economics in one sentence.
What Happens After a Ransomware Attack?
More than half still end in encryption, and most organizations recover within a month.
| Outcome (Sophos State of Ransomware 2026) | Value |
|---|---|
| Attacks that encrypted data | 56% (50% in 2025 report; peak 76% in 2023 report) |
| Data encrypted and also stolen | 16% |
| Attacks stopped before encryption | 41% |
| Encrypted victims that restored from backups | 66% (54% in 2025 report) |
| Encrypted victims that paid to get data back | 48% (49% in 2025 report) |
| Mean recovery cost, excluding ransom | $1,700,200 (+11%) |
| Median recovery cost, excluding ransom | $375,000 (unchanged) |
| Recovered within one week | 55% |
| Recovered within one month | 83% |
| Took longer than three months | 3% |
| Stopped attacks before encryption: 100–250 employees vs 3,001–5,000 | 34% vs 46% |
Beyond Sophos, IBM’s 2026 Cost of a Data Breach study found ransomware incidents in 39% of breached organizations, up from 34% the year before, across 602 organizations breached between March 2025 and February 2026. The most common pressure tactic was exploiting brand reputation (41%), followed by employee data (35%) and intellectual property (31%). IBM put the global average breach cost at $4.99 million.
The single costliest event of 2025 was the attack on Jaguar Land Rover, which halted production in several countries; Chainalysis cites an estimate of £1.9 billion (about $2.5 billion) in economic damage.
For sector-level recovery bills, see ransomware recovery cost. For how insurers price these events, see our cyber insurance statistics.
What Changes for Ransomware in 2027?
Three government regimes will start producing ransom-payment data that no private tracker has today.
| Jurisdiction | Rule | Status as of October 28, 2026 | What it will measure |
|---|---|---|---|
| United States | Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA): ransom payments reported to CISA within 24 hours, covered incidents within 72 hours | Final rule received for White House (OIRA) review on October 1, 2026; effective date set by the final rule | Ransom payments by critical infrastructure entities; HIPAA Journal reports an estimated 316,000 covered entities |
| Australia | Cyber Security Act 2024, Part 3: report any ransomware or cyber-extortion payment within 72 hours | In force since May 30, 2025; active compliance phase since January 1, 2026 (Home Affairs factsheet) | Payments by businesses with annual turnover above A$3 million and critical infrastructure entities |
| United Kingdom | Targeted ban on ransom payments by the public sector and critical national infrastructure; payment-prevention regime; mandatory incident reporting | Government confirmed it will proceed in its July 22, 2025 consultation response; legislation pending | Intent-to-pay notifications and incidents, with 72 hours as the proposed reporting window |
What this means for the numbers: once CIRCIA reports start flowing, the US will have its first official count of ransom payments by critical infrastructure. If the RYI keeps falling and payment reporting rises, the gap between “attacks” and “paid attacks” will widen in the public record, not just in vendor surveys.
The 2027 data calendar, based on when each 2026 edition appeared: GuidePoint’s annual report (published January 15 in 2026), Chainalysis’s ransomware chapter (February 26 in 2026), the FBI IC3 annual report (spring), Verizon’s DBIR (May 2026) and Sophos’s State of Ransomware (2026 edition). This page updates when each lands, and the 2026 RYI reading will be published once Chainalysis reports 2026 payments.
Marcus Chen: Coveware’s April 2026 report argued that agentic AI is making patch management dramatically harder, and Verizon already ranks vulnerability exploitation as the top initial access vector. Email beat exploits in Sophos’s 2026 survey. Do not plan 2027 as if that ranking is permanent.
Methodology
Axis Intelligence Research fetched every source on this page between October 27 and October 28, 2026, and logged each figure with its URL and retrieval date in the CSV. We used primary producers only: government agencies (FBI IC3, CISA via reginfo.gov, Australia’s Department of Home Affairs, UK Home Office), survey and research publishers (Sophos, IBM with Ponemon Institute, Verizon), and measurement firms that collect their own data (Chainalysis on-chain analytics, Coveware incident-response cases, GuidePoint and Check Point leak-site tracking). Vendor research is labeled by vendor; each of these firms sells security or incident-response services.
Ransom Yield Index (RYI). RYI(year) = 100 × [Chainalysis payments(year) ÷ payments(2024)] ÷ [claimed victims(year) ÷ claimed victims(2024)]. Base year 2024 = 100. Victim growth uses the figure Chainalysis reports (+50%, from eCrime.ch); GuidePoint’s +58% is the cross-check. The index measures revenue intensity per publicly named victim; it is not an average ransom. The next reading follows Chainalysis’s report on 2026 payments.
2026 pace calculation. Sum of GuidePoint’s published Q1–Q3 2026 counts divided by the same three quarters of 2025, as first published in each quarterly report. Daily rate = 7,174 ÷ 273 days. Full-year scenarios hold Q4 2026 at three stated levels; they are not predictions.
Mean-to-median skew. Coveware average payment ÷ Coveware median payment, same quarter.
What we did not combine. Payment rates from different sources are shown side by side, never averaged, because each counts a different population. Leak-site counts from GuidePoint and Check Point are not merged. IBM’s breach-cost figures cover all breach types and are not presented as ransomware-only costs.
What the data cannot see. Leak-site counts miss victims who pay quickly and can include reposts. Chainalysis sees only on-chain payments it can attribute, and its totals are revised upward over time. Survey data (Sophos, IBM) reflects respondents who agreed to participate. Verizon figures come from the full 2026 DBIR (page numbers cited) and its public executive summary.
About This Dataset
The file ransomware-statistics.csv holds every number on this page, one observation per row, with source organization, document, URL, retrieval date, a primary-source flag and, for Axis calculations, the method used. It covers 2023–2026 data published between October 2025 and October 2026. Updates are made when a source publishes new data, not on a fixed calendar.
License: CC BY 4.0. Attribution line: Axis Intelligence Research, Ransomware Statistics 2026, 2026.
How to Cite
APA: Axis Intelligence Research, & Chen, M. (2026, October 28). Ransomware statistics 2026: Record attacks, shrinking payouts, and what the numbers say about 2027. Axis Intelligence. https://axis-intelligence.com/ransomware-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “Ransomware Statistics 2026: Record Attacks, Shrinking Payouts, and What the Numbers Say About 2027.” Axis Intelligence, 28 Oct. 2026, axis-intelligence.com/ransomware-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “Ransomware Statistics 2026: Record Attacks, Shrinking Payouts, and What the Numbers Say About 2027.” Axis Intelligence, October 28, 2026. https://axis-intelligence.com/ransomware-statistics/.
Citing the index: Axis Intelligence Research (2026). Ransom Yield Index (RYI), 2025 reading: 61.3 (2024 = 100). https://axis-intelligence.com/ransomware-statistics/
Ransomware Questions Security Teams Are Asking in 2026
If we pay, will the attackers delete our data?
There is no way to verify it, and the record says often not. Coveware notes that the 2024 takedown of LockBit revealed the group had kept victims’ data despite promises to delete it. Partly for that reason, only 15% of data-theft-only cases in Coveware’s Q2 2026 caseload ended in payment.
Why are ransomware attacks at a record while ransom payments fall?
Because volume and revenue are moving apart. Leak-site victims rose 50% in 2025 per Chainalysis, while on-chain payments fell 8% to $820 million. Axis Intelligence Research’s Ransom Yield Index puts revenue per claimed victim at 61.3 in 2025, against 100 in 2024.
How many ransomware attacks happen per day in 2026?
At least 26 publicly posted victims per day on average from January to September 2026, an Axis Intelligence Research calculation from GuidePoint’s 7,174 victims over 273 days. That counts only victims named on leak sites; organizations that pay quickly or are never posted are not included.
Do backups still stop ransom payments?
They help, but they do not end the decision. In Sophos’s 2026 survey, 66% of organizations with encrypted data restored from backups, and 48% paid; many did both. Backups do nothing about stolen data, which is why data extortion now leads in Coveware’s caseload.
Does MFA stop ransomware?
Not on its own. Sophos found that 97% of victims breached through compromised credentials had multi-factor authentication enabled somewhere at the time of the attack. The attacks came through systems where it was missing or bypassed, such as VPNs, firewall consoles and help-desk resets.
Which ransomware group is the most active right now?
The Gentlemen narrowly overtook Qilin in Q3 2026, with 12.9% of posted victims against 12.6%, according to GuidePoint. In the FBI’s 2025 complaint data, Akira ranked first and Qilin second.
Will companies have to report ransom payments in the US in 2027?
Critical infrastructure entities will, once CISA’s CIRCIA rule takes effect: ransom payments must be reported within 24 hours. The final rule entered White House review on October 1, 2026; its effective date will be set in the published rule.
Is the “average ransom payment” a useful number for budgeting?
Rarely. In Coveware’s Q2 2026 data the average payment ($1,880,612) was 12.5 times the median ($150,000), an Axis Intelligence Research calculation. Budget against the median for your revenue band; Sophos reports a median demand of $140,000 for organizations under $50 million in revenue.
Related: cybersecurity statistics · data breach statistics · phishing statistics · critical infrastructure cyberattack statistics · zero-day tracker
Correction, October 28, 2026: An earlier version of this page, published April 12, 2026 and last updated June 19, 2026, contained figures we could not verify or that were wrong. It described Sophos’s 2025 $1 million ransom figure as a mean (it was a median); listed RansomHub among the FBI’s top five 2025 variants (it ranked sixth) and LockBit as absent from the FBI list (it ranked seventh); attributed to Verizon a finding on access-broker activity preceding ransomware by about 30 days (the finding is Chainalysis’s); stated that IC3 identified about 45 new variants in 2024 (IC3 reported 67); and published an Axis Ransomware Exposure Composite Index (ARECI) whose sector inputs do not exist in the cited sources. The ARECI has been withdrawn and replaced by the Ransom Yield Index (RYI), whose inputs and formula are published above. Outdated 2025 figures have been replaced with 2026 editions. Report errors to [email protected].