Embed this dashboard

Copy the code below and paste it into any HTML page or WordPress Custom HTML block. The iframe resizes itself to fit its content.

Free to embed under CC BY 4.0 with attribution to Axis Intelligence Research.
Axis Intelligence Research · Pricing benchmark · Exposure simulator

Ransomware Attack Cost 2026

Axis Intelligence Research · co-author Marcus Chen · updated October 3, 2026 · source & dataset
FIGURES VERIFIED OCT 2, 2026
6 PRIMARY SOURCES · 121 SOURCED ROWS · CC BY 4.0
Price a ransomware attack on your organization
Benchmarks from 2,158 hit organizations · USD
Estimated total bill
—
Your band’s RRB™
—
0%0.2%0.4%0.6%
Ransom Recovery
Median demand
—
What attackers ask, your band
Median paid
—
Sector pay rate
—
Of encrypted victims who paid
Recovery vs ransom
—
Median recovery cost
$375K
FLAT YoY
Excludes ransom · mean $1.70M
Median ransom paid
$769K
↓ from $1M
Sophos, 530 paying orgs
Median demand
$698K
−65% IN 2 YRS
$2.0M in 2024 report
Peak RRB™
0.53%
$250–500M BAND
2.6× the sub-$250M burden
Encrypted victims who paid
48%
66% USED BACKUPS
Up from 54% using backups
Sophos · State of Ransomware 2026 (n=2,158)
Coveware by Veeam · Q2 2026
Chainalysis · 2026 Crypto Crime Report
IBM · Cost of a Data Breach 2026
FBI IC3 · 2025 Report · Marsh GIMI Q2 2026
Axis proprietary metric · Ransom Revenue Burden (RRB™)
Highest burden 0.53% · $250–500M revenue
Formula. RRB = median ransom payment in revenue band ÷ band revenue midpoint × 100. Payments from Sophos State of Ransomware 2026; midpoints by Axis Intelligence Research ($25M, $150M, $375M, $750M, $3.05B; the open $5B+ band uses its $5B floor, so its reading is a ceiling). Click a column to load that band into the simulator. Burden is flat at 0.20% below $250M, jumps to 0.53% in the $250–500M band, then collapses above $500M — the band that pays the most relative to its size also paid 100% of the median demand.
One ransom, five prices · why published figures disagree
Spread 13× between medians
Log scale, $10K–$10M. Each source sees a different victim population. Chainalysis traces every on-chain payment, including small extortions ($59,556 median, 2025). Coveware by Veeam reports companies that hired a response firm ($150,000 median, Q2 2026; a few large law-firm extortions pushed its average to $1,880,612). Sophos surveys organizations of 100–5,000 employees ($769,000 median paid; $3.13M mean demand). The right figure to quote is the one whose population matches the organization being priced.
Demand vs payment by revenue band · medians, USD
Sophos State of Ransomware 2026. Log scale. Demand and payment medians come from different respondent subsets, so payment can exceed demand within a band.
How recovery bills are distributed · % of victims
Sophos 2026, cost to rectify the most significant attack, excluding ransom. 29% of victims spent $1M or more.
Attacker’s cost vs victim’s bill · the asymmetry in three prices
Access price fell −69% since Q1 2023
Initial access, Q1 2026
$439
Average dark-market price for a network foothold (Darkweb IQ via Chainalysis) · $1,427 in Q1 2023
→
Median recovery bill
$375,000
What the typical victim spends to rebuild, ransom excluded (Sophos 2026)
+
Median ransom paid
$769,000
If the victim pays (Sophos 2026) · ransomware actors took ~$820M on-chain in 2025
Shown side by side, never merged. A dark-market listing price and a victim survey measure different things, so no ratio is computed between them. Chainalysis estimates initial access brokers received at least $14M on-chain in 2025 against roughly $820M paid to ransomware actors — about 58 to 1. Validated domain-level access still sells at a premium.
Who pays · ransom payment rate by sector, encrypted victims
Range 32%–72% · all-sector 48%
Downtime tolerance drives the rate. Local and state government paid in 72% of encryption cases, more than double retail (32%). Citizen-facing services can’t wait out a rebuild; a retailer can sell on paper for a week. The white tick marks the 48% all-sector rate. Click a sector to load it into the simulator. Source: Sophos State of Ransomware 2026, n=1,214 organizations with encrypted data.
Recovery clock · time to full recovery
Within a week 55% · within a month 83%
Average: three weeks. Unchanged from the 2025 report and down from five weeks in the 2024 report. Only 3% needed more than three months. Every extra week sits on the recovery line of the bill, not the ransom line. Source: Sophos 2026, n=2,158.
Ransom deflates, recovery doesn’t · 2024–2026 reports
Sophos report years. Median demand fell from $2.0M to $0.70M; mean recovery rebounded 11% to $1.70M after falling from $2.73M.
Where attacks start · technical root cause, 2026
Sophos 2026. Email and phishing now cause half of attacks; exploited vulnerabilities fell 14 points to 18%. 59% of demands topped $1M when the firewall was the entry point.
On-chain ransomware payments · total, USD
Chainalysis 2026 Crypto Crime Report. 2025 total expected to approach $900M as attribution improves. Median on-chain payment rose from $12,738 to $59,556.
FBI IC3 ransomware complaints & reported losses
FBI IC3 2025 Annual Report. Reported losses exclude downtime, lost business and remediation — about $8,950 per 2025 complaint (Axis calculation).
Full revenue-band benchmark · click a header to sort
Cyber insurance rates −4% globally, Q2 2026 (Marsh)
Revenue bandMedian demandMedian paidShare of demand paidRRB™Est. paying billBill % revenue
Sources: Sophos, State of Ransomware 2026 (Vanson Bourne survey, Q1 2026, 2,158 organizations in 17 countries, 100–5,000 employees). Share of demand paid from the 507 organizations disclosing both figures. RRB™, estimated paying bill (band median payment + $375,000 global median recovery) and bill as % of band midpoint calculated by Axis Intelligence Research; the $5B+ band uses its $5B floor.