This is a comprehensive list of statistics and trends related to ransomware cyberattacks on small businesses.

You might think of ransomware as something that only affects Fortune 500 companies. Yes, headlines usually focus on attacks targeting major organizations or critical infrastructure. But attackers frequently target small businesses as well.

Furthermore, the impact of a ransomware attack can be relatively worse for smaller businesses, which are often less able to respond and recover than their larger counterparts.

Thanks to AI, ransomware attacks are growing increasingly sophisticated, as are defenses. But many small businesses remain largely unprepared for a ransomware attack.

So just how common is this type of cyber attack? Who’s usually targeted, how do attacks usually play out, and what is necessary to prevent and recover from them?

Read on to find answers to these questions and more.

Editor’s picks

Prevalence of Ransomware Attacks

Around 7 in 10 companies have been the victim of at least one successful ransomware attack (Veeam)

In this case, “successful” means the attackers encrypted or exfiltrated data from the victim. Note that ransomware attacks can still be harmful even when data is unaffected. Attackers may attempt to extort the victim (this tactic is more common with smaller businesses compared to large organizations).

72% of businesses worldwide are affected by ransomware attacks each year (IBM)

That figure is an all-time high. This jump shows how ransomware has shifted from sporadic incidents to something businesses must deal with on a regular basis. With attackers increasingly automating operations and recycling successful playbooks across industries, it’s likely that this number will continue to climb.

18% of middle market executives suffered a data breach in the previous year (RSM)

Fortunately, smaller firms are less likely to experience ransomware attacks or demands. As of last year, 24% of executives of middle-market firms overall experienced an attack or demand.

Organizations faced an average of 2,027 cyber attacks per week in Q1 2026 (Swif)

That marked a 9% year-over-year increase. The education sector saw over double the average, with 4,656 weekly attacks recorded.

59% of organizations were hit by some sort of ransomware in 2024 (Sophos)

That’s down from 66% in 2023 and 2022, but much higher than 37% in 2021. 

The FBI’s Internet Crime Complaint Center, or IC3, received 3,611 reports of ransomware in 2025 (IC3)

That’s a 14% increase from 2024, when the IC3 received 3,156 complaints.

In 2023, the office received 2,825. And in 2022, that figure was 2,385. 

Ransomware represented just 0.36% of total complaints to the FBI’s IC3 (IC3)

Other complaints, like phishing attacks, were far more common. This may be because the IC3 also fields complaints from individuals, who are less likely to be targets of ransomware than businesses.

Impacts of Ransomware Attacks

In 2025, $20.87 billion was lost to cyber attacks in the US (IC3)

That’s a 26% increase in losses from 2024. It includes all kinds of cyber attacks reported to the FBI’s Internet Crime Complaint Center, or IC3, including ransomware.

$32,320,105 was lost to ransomware in 2025 (IC3)

That’s 159% more than in 2024, when organizations reported losses of $12,473,156 to the IC3.

Furthermore, the IC3 notes this figure is almost certainly an underestimate. It doesn’t include attacks reported directly to the FBI, and doesn’t include costs from lost wages, equipment, legal fees, and customer complaints.

Cybercrime costs companies $8 trillion each year (Embroker)

For context, that’s more than the combined market caps of Microsoft, Apple, and Alphabet, some of the world’s most valuable companies.

51% of ransomware victims managed to restore the majority of their servers (Veeam)

Fortunately, the majority of victims are able to get up and running again (at least partially). However, only around 10% of victims managed to recover 90%+ of their servers.

On average, $591,988 is paid per ransom demand (Coveware)

That’s a 57% increase from the previous quarter.

The median ransom payment in Q4 2025 was $325,000 (Coveware)

That’s a 132% increase from the previous quarter. The median figure is a little more useful than the mean, which is skewed by massive payments extracted from large firms.

Businesses paid just 20% of ransom payments in Q4 2025 (Coveware)

That’s an all-time low. For comparison, 85% of ransom payments were made in Q1 2019.

60% of small businesses that experience a cyber attack go out of business within 6 months (Qualysec)

Cyber attacks can be particularly damaging to smaller businesses, which may not have the resources to recover from them.

The average cost of a data breach has reached $4.44 million (IBM)

That’s down $0.44 million from the highest cost ever recorded in 2024.

Ransomware recovery costs, excluding ransom payments, averaged $1.53 million (Sophos)

That’s a significant decrease from 2024, when recovery costs averaged $2.73 million.

On average, it takes over 2 weeks to detect, respond to, and contain a cybersecurity issue (ExtraHop)

This leads to an average of 37 hours of downtime each time a security incident takes place.

Around 2 in 5 IT and cybersecurity teams that experienced an attack are now more anxious about future attacks (Sophos)

A ransomware attack can be extremely stressful for an organization, especially for IT staff directly responsible for dealing with the threat. This emotional impact can have lasting effects, something that may get missed in the chaos. 

Cybersecurity leadership was replaced after 25% of attacks (Sophos)

Even accounting for the fact that a significant proportion of attacks are unsuccessful, it seems that many successful attacks are not blamed on cybersecurity leadership.

The average ransomware payment increased by over $1 million in the last year (ExtraHop)

The number of ransomware attacks per organization has actually fallen from 8 per year to between 5 and 6. Nonetheless, the average payment has seen a substantial increase from $2.5 million to $3.6 million.

The percentage of companies impacted by at least one successful ransomware attack has remained the same since 2024 (Veeam)

Here, “successful” means the attackers encrypted or exfiltrated the victim’s data. The percentage of companies impacted declined from 75% to 69% in 2024, but remained unchanged in the most recent 2025 report.

The median ransom payment fell by 34% in 2025 (Sophos)

According to Sophos, the median payment in 2024 was $2 million. In 2025, it was $1,324,439. They argue this is due to a drop in payments worth at least $5 million.

The percentage of ransom payments worth at least $5 million fell 11% (Sophos)

In 2024, ransom payments of at least $5 million represented 31% of payments, but by 2025, that figure fell to 20%. 

Around 1 in 3 cyber threats reported are classified as ransomware threats (IC3)

Data breaches are the most common reported threat (39%), closely followed by ransomware (36%). SIM swap (10%), malware (9%), and botnet (7%) follow.

There were 63 new ransomware variants in 2025 (IC3)

At least 63 new variants were detected by the FBI last year. This adds to the 67 reported in 2024. Top new variants include AKIRA, Qilin, INC./Lynx/Sinobi, and BianLian. 

94% of organizations increased their ransomware recovery budget (Veeam)

This report, also published by Veeam, notes that cyber criminals target small and medium businesses for extortion, assuming they lack the means to recover their data. 

19 in 20 organizations raised their ransomware prevention budget (Veeam)

This is based on a survey of 1,300 organizations. Of those, 900 experienced at least one ransomware attack in 2024. 

76% of cybersecurity leaders are worried about the increasing sophistication of cyber threats (IBM)

AI has allowed attackers to develop increasingly complex methods.

The communications sector experienced the largest increase in year-on-year ransomware attacks between 2023 and 2024, at 177% (Checkpoint)

Several industries experienced many more published ransomware attacks in Q1 2024 compared to Q1 2023. The communications sector experienced the most significant increase in attacks, but in 2024 still accounted for just 4% of total published ransomware attacks.

The industry with the second-largest year-on-year increase in ransomware attacks was manufacturing, at 96%. 

Average ransomware recovery costs, excluding ransom payments, fell by 44% in 2025 (Sophos)

In 2023, the average recovery cost was $1.82 million. Through 2024, that figure rose to $2.73 million. But in 2025, it fell again, to $1.53 million.

Ransomware attacks due to compromised credentials declined by 6% (Sophos)

In 2024, 29% of ransomware attacks relied on compromised credentials. By 2025, that figure had fallen to 23%.

The percentage of ransomware attacks involving data encryption fell by 20% (Sophos)

According to Sophos, 70% of ransomware attacks in 2024 involved data encryption. In 2025, that figure fell to 50%. This is likely because organizations have become more capable of stopping attacks before any data is encrypted.

The percentage of ransomware attacks stopped before encryption occurred rose by 20% from 2020 to 2025 (Sophos)

In 2020, organizations managed to halt a ransomware attack before encryption occurred just 24% of the time. By 2025, that figure rose to 44%. 

The proportion of ransomware victims subject to extortion-style ransomware attacks doubled between 2024 and 2025 (Sophos)

In 2024, just 3% of ransomware attacks involved extortion, where a ransom is demanded despite no data being encrypted. But in 2025, that figure rose to 6%.

The percentage of organizations that fully recovered from a ransomware attack in a single day doubled from 2023 to 2025 (Sophos)

In 2023, just 8% of victims fully recovered in a day. The next year, that figure fell further, to 7%. But in 2025, it jumped to 16%. 

The global ransomware protection market is projected to be worth $99.85 billion by 2033 (Grand View Research)

That’s based on a compound annual growth rate of 15.8%. A more conservative estimate has the global market being worth just $43.4 billion in 2032. That’s based on a value of $15.1 billion in 2023 and a CAGR of 12.6%. 

Average dwell times of ransomware threats declined from 10 days to 5 (Barracuda)

That’s the shortest in over a decade. According to research by Google Mandiant, a rise in ransomware incidents is responsible for decreasing overall dwell times for cyber attacks, perhaps implying ransomware is easier to detect than other attacks.

Who is Targeted by Ransomware

Approximately 2 in 5 ransomware attacks in Q4 2024 targeted companies with between 101 and 1,000 employees (Coveware)

The next most-targeted group was companies with 11-100 employees (29.7% of attacks) and large organizations with 1,001-10,000 employees (16.1%).

Companies with 1-10 employees represented just 3.4% of attacks, perhaps reflecting the fact that very small businesses may be less likely to have enough cash to make an attack worthwhile.

8.17% of reported ransomware attacks targeted critical manufacturing (IC3)

That made critical manufacturing the most common target for ransomware attacks. It was followed by healthcare (238 complaints), government facilities (220), financial services (190), IT (138), commercial facilities (111), food and agriculture (81), transportation (57), energy (38), and chemical (35). 

The most commonly targeted age group was 50-59, representing 8% of all complaints (IC3)

Generally, older individuals are more at risk of ransomware attacks. They also reported the most losses from ransomware attacks in 2024. 

60% of small businesses say cybersecurity threats, including ransomware, are a top concern (US Chamber of Commerce)

That makes cyber threats one of the most common concerns of small businesses. More small businesses are concerned about cybersecurity threats than about supply chain breakdowns (58%), a pandemic (54%), bad weather (45%), theft (42%), natural disasters (39%), or terrorism (37%).

It’s quite notable that roughly 35% more small businesses are concerned about cybersecurity threats than physical theft.

4,484 cyber attacks in Q1 2025 targeted education or research organizations, making them the most common target (Checkpoint)

The next most common targets were government or military institutions (2,678 attacks), then telecommunication organizations (2,664). 

North America accounted for 62% of published ransomware attacks in Q1 2025 (Checkpoint)

That made North America the region most impacted by ransomware attacks in Q1 2025. Almost 1,000 ransomware attacks were published worldwide that quarter. 

Manufacturing accounted for around 1 in 3 published ransomware attacks (Checkpoint)

That made manufacturing the most-targeted industry globally. It was targeted almost twice as much as the year before. 

The next most-targeted industry was healthcare, which accounted for 11% of published attacks. This industry also experienced significantly more attacks than the year before, posting a 63% increase year-on-year.

In third was the retail and wholesale industry, which accounted for 8% of published attacks in Q1 2024.

Why Businesses Fall Victim to Ransomware Attacks

Over half of ransomware attacks are not detected at initial access (ExtraHop)

Only 17.59% of ransomware attacks are detected at the reconnaissance stage. A further 29.27% of ransomware attacks are detected at initial access.

Further along the process, 22% are discovered at the lateral movement and privilege escalation stage. While 12% are detected during data exfiltration, 13.11% during encryption, and 5.53% at the ransom demand stage.

69% of ransomware victims thought they were well-prepared before being attacked (Veeam)

Research suggests IT and security teams often suffer from a false sense of confidence when it comes to ransomware. After being attacked, confidence dropped by more than 20%. 

Interestingly, the confidence of CIOs dropped twice as much after an attack compared to CISOs. That implies CISOs have a more accurate picture of their organization’s security abilities. 

30% of ransomware attacks on small businesses occurred because of compromised credentials (Sophos)

Compromised credentials are the most common technical root cause of ransomware attacks on small businesses (with 100-250 employees). It’s closely followed by exploited vulnerabilities, which occurred in 29% of attacks.

While smaller businesses are more likely to fall victim to ransomware due to compromised credentials, businesses overall are more likely to experience ransomware attacks due to exploited vulnerabilities; 32% of attacks in 2025 happened because of exploited vulnerabilities, compared to 23% due to compromised credentials.

About a third of ransomware incidents occur as a result of exploited vulnerabilities (Sophos)

That makes exploited vulnerabilities the most common technical root cause of ransomware attacks. It’s followed by compromised credentials, which occurred in 23% of ransomware attacks.

Businesses cite an average of 2.7 factors that contributed to their becoming victims of a ransomware attack (Sophos)

Common factors include protection issues, resourcing issues, and security gaps.

40.2% of ransomware victims said a lack of expertise contributed to their being successfully attacked (Sophos)

That makes lack of expertise the most common factor contributing to an organization falling victim to ransomware.

Businesses can address this by investing in structured education, such as cybersecurity bachelor’s degree programs, which equip professionals with skills to identify vulnerabilities and improve defenses.

However, ransomware attacks usually happen due to multiple factors. Lack of expertise was followed very closely by security gaps the organization was not aware of, which contributed to 40.1% of attacks. A lack of people or capacity contributed to 39.4% of attacks.

45% of ransomware attacks on businesses with 100-250 employees occurred due to known security gaps that weren’t addressed (Sophos)

Known security gaps were the most common operational root cause (rather than technical root cause) of ransomware attacks on small businesses. The most common cause for businesses with 251-500 employees was a lack of people or capacity.

How Ransomware Attacks Play Out

97% of organizations whose data was encrypted managed to recover it (Sophos)

However, this process took more than a week for 47% of affected organizations. 

53% of organizations fully recovered from a ransomware attack within a week (Sophos)

That’s a significant increase from the 35% of organizations that recovered within a week in 2024.

And 16% fully recovered within a single day (Sophos)

Recovering within a day was more likely when the data hadn’t been encrypted. Only 9% of organizations that had their data encrypted recovered in a day, compared to 24% of organizations that did not have their data encrypted.

The top ransomware variant in Q2 2025 was Akira, representing 19% of attacks (Veeam)

Researchers noted that the variant was often used to target smaller businesses. Other top variants include Qilin (13%) and Lone Wolf (9%).

87% of ransomware cases involved exfiltration (Coveware)

That’s an increase of 11% from Q3 2024, when 76% of cases involved exfiltration. Exfiltration is becoming a more common tactic in ransomware attacks.

85% of ransomware cases involved data encryption (Coveware)

Nevertheless, encryption remains a very common ransomware tactic. More conservative estimates do put the overall figure a little lower, though.

According to a 2020 report by the US Senate Committee on Homeland Security & Government Affairs, cryptocurrencies enable ransomware attacks because attackers can use them to make transactions more difficult to trace.

In 2020, the US government reported that ransomware attackers extorted at least $692 million in cryptocurrency. That’s several times higher than the $152 million reportedly extorted in 2019.

89% of businesses had their backup repositories targeted (Veeam)

Proper backups can be essential when recovering from a ransomware attack. According to this report by Sophos, over two-thirds of organizations targeted by ransomware attacks use backups to restore encrypted data. However, backups should be protected, as attackers will almost always target them, too.

Just 41% of middle-market companies that experienced at least one ransomware attack were completely successful in defending themselves (RSM)

31% of companies said their existing security measures were successful. Another 28% said their measures were partially successful. 

A ransomware attack affects 49% of an organization’s computers on average (Sophos)

It’s very rare for an attack to affect just a few or almost all of an organization’s devices. For example, just 4% of attacks impacted at least 90% of an organization’s devices.

14% of ransomware victims lose their data to theft (Sophos)

Having data stolen was more common among ransomware victims who had their data encrypted. Of those businesses, 28% had their data stolen.

Smaller organizations are 40% less likely to have data stolen compared to larger organizations (Sophos)

Perhaps attackers feel the data kept by smaller organizations is less valuable.

But smaller organizations were 10% more likely to be extorted (Sophos)

Here, “extorted” means being held to ransom without data being encrypted. Extortion-style attacks were far more common on smaller businesses. For example, 13% of victims with 100-250 employees experienced this kind of attack, compared to just 3% of victims with 3,001-5,000 employees. 

On average, ransomware intrusions progress from initial access to data exfiltration within hours rather than days (Coverware)

This reflects a continued collapse in dwell time due to social engineering-driven attacks.

“Dwell time” refers to the time between an attacker gaining access to a network and one of three outcomes: the victim detects the attack; the attacker succeeds in their goal and exits the network (ideally without being noticed, and thus able to re-enter in the future); the attacker detonates their attack, in this case, the ransomware payload.

Dwell times are usually measured in days or even weeks. However, for ransomware attacks, a shorter dwell time is often ideal, as the longer an attacker is in a network, the greater the chance they are discovered. Conversely, a shorter dwell time is more dangerous for victims, who are given less time to detect and respond to an incoming attack.

That’s likely why dwell times are shortening, on average. Cyber defense capabilities have improved, so attackers want to implement their ransomware attack as quickly as possible to avoid detection. 

How Businesses Respond to Ransomware Attacks

Around one-third of affected organizations didn’t pay a ransom (Veeam)

25% of affected businesses managed to recover their data despite not paying a ransom. 9% of affected businesses were not asked for a ransom. And 2% refused to pay a ransom and failed to recover their data. 

49% of organizations hit by ransomware paid their ransom (Sophos)

That’s the second-highest rate of ransom payment in six years, according to Sophos. In 2024, a record was set, with 56% of victims paying their ransom. In 2020, only 26% of affected firms paid their ransom.

82% of businesses that paid a ransom paid less than what was demanded (Veeam)

60% of affected businesses paid less than half the sum demanded by their attackers.

31% of businesses paid more than their original ransom request (Sophos)

This study presented a more sobering picture of ransom payments. Only 44% of surveyed businesses hit with ransomware in 2024 paid less than the original ransom demand. Another 24% said their payment matched the request.

Approximately 7 in 10 businesses that paid a ransom were attacked again (Veeam)

Paying a ransom might seem necessary at the time. But it exposes your organization as one that has money and is willing to spend it on ransoms, putting a target on your back. 

That’s why nations around the world are trying to prevent organizations from paying ransoms at all. In 2023, for example, 48 countries signed a pledge to “strongly discourage” organizations from paying a ransomware demand. In January 2025, the UK proposed legislation that would outright ban public sector organizations from paying ransoms. Similar laws have been passed in Florida and North Carolina. 

68% of organizations affected by ransomware used backups to restore encrypted data (Sophos)

Remember, encryption is an extremely common technique used by ransomware attackers. It was used in 85% of attacks in 2024. Maintaining recent and secure backups should therefore help organizations respond to ransomware attacks.

26% of impacted organizations used “other means” to get their data back (Sophos)

That includes using decryption keys that have been made public and working with law enforcement.

Ransomware Protection Statistics

The ransomware protection market is valued at an estimated $35.2 billion (Grand View Research)

The ransomware protection market is valued at an estimated $35.2 billion

North America accounted for 36.9% of the market. The largest share by component was solutions, which accounted for 66.95% of ransomware protection revenue.

The cyber crisis management market is worth $6.26 billion (Wise Guy Reports)

44.2% of cyber crisis management is cloud-based. The largest market is North America, which accounts for 39.8% of the global market.

The ransomware resilience assessment market is worth $11 billion (Archive Market Research)

This report estimates it will grow to $19.05 billion by 2030, based on a CAGR of 11.61%. The largest market is North America, which accounts for 40% of the global market. It’s followed by Europe (35%) and Asia-Pacific (15%). 

What Businesses Do – and Need to Do Better – to Prevent Ransomware Attacks

98% of organizations say they have a playbook used for responding to ransomware attacks (Veeam)

However, the report notes that more than half of the 1,300 organizations surveyed lacked some of the essential features required to execute that playbook effectively.

Examples of these features include a pre-defined chain of command when responding to attacks (30% of businesses), arrangements for alternative infrastructure in the event of a compromising attack (37%), and backup verifications (44%).

Organizations assign 3% more of their IT budget to security than to recovery (Veeam)

On average, organizations devoted 31% of their IT budget to security and 28% of their IT budget to recovery. 

Just 26% of organizations have a ransom payment decision process in place (Veeam)

Establishing this process can be crucial in rapidly responding to an attack. Delays can compound the costs of an attack.

30% of organizations have a pre-defined chain of command in place for dealing with ransomware attacks (Veeam)

An established chain of command can help organizations respond rapidly to attacks. That’s important because a separate report found that 43% of victims received a discount for paying their ransom quickly. 

48% of small businesses have trained staff on cybersecurity measures (US Chamber of Commerce)

For organizations building in-house talent over the long term, that often starts with hiring candidates who have recently completed an online cybersecurity bachelor’s program.

A lack of training leaves organizations vulnerable to attacks.

62% of small businesses have a rainy-day fund for a crisis (US Chamber of Commerce)

With average ransoms in the hundreds of thousands of dollars, organizations may want to consider putting aside some funds in the event they’re attacked. 

52% of businesses think they need to improve collaboration between IT operations and security teams to improve cyber resilience (Veeam)

Many businesses believe a complete overhaul is required to properly align both of these teams. Collaboration and communication between IT and security are vital when defending against and responding to ransomware attacks. 

Just over a quarter of small businesses are just one disaster/threat away from shutting down (US Chamber of Commerce)

This is more likely to be true for small businesses in operation for 10 years or less (33%) and businesses owned by millennials or Gen Z (34%). 

81% of middle-market organizations expect their cybersecurity budget to increase (RSM)

It’s clear that the vast majority of mid-sized businesses recognize the growing threat posed by cyber attacks.

37% of smaller middle-market businesses work with external partners to plan for cyber attacks (RSM)

Collaborating with an external partner can be an excellent way for smaller businesses without an extensive cybersecurity staff to prepare for possible attacks.

82% of middle-market firms carry a cyber insurance policy, a record-high (RSM)

In 2024, 76% of firms carried insurance. However, the report noted that familiarity with policy coverages declined, from 75% in 2024 to 69% in 2025. Smaller firms were particularly likely to have low familiarity with their insurance policy coverages. In 2024, 66% reported familiarity, but in 2025, just 51% did so. 

51% of middle-market firms outsource management of cybersecurity risk and compliance (RSM)

Cybersecurity risk and compliance management was the most common cybersecurity function outsourced in 2024. It was followed by incident response and forensics (46% of firms), security operations center (46%), training for security awareness (44%), and vulnerability management (44%).

Around 2 in 5 organizations’ security is negatively affected by limited visibility into the entire environment (ExtraHop)

Limited visibility is the top challenge impacting a fast response to cybersecurity threats. This is followed by overwhelming alert volume, disparate and poorly integrated tools, and inefficient or manual SOC workflows – all of which affect 34% of organizations.