NEW YORK, September 17 — The average ransomware incident costs a business $5.08 million once downtime, remediation, legal work and disruption are added up, according to IBM’s Cost of a Data Breach Report 2025. The median ransom payment, by contrast, is $139,875, per the 2026 Verizon Data Breach Investigations Report. That gap is the whole story.
The ransom is the cheap part. Think of it like a house fire where the match costs a nickel and the rebuild costs the block.
A ransomware attack does not arrive as a single bill. It creates several at once: lost revenue while systems sit dark, recovery and remediation expenses, legal and compliance work, and operational disruption that drags on until the business is back on its feet. The longer critical systems stay unavailable, the bigger the tab grows.
The recovery gap
Most organizations badly misjudge their own bounce-back time. The Datto State of BCDR Report 2025 found that more than 60% believed they could recover from an incident in under a day. Only 35% actually did.
Every extra hour of downtime means lost productivity, delayed transactions, disrupted customer service, and IT staff pulled off their normal jobs to fight the fire. For mid-market businesses, recovery time is not an IT metric.
It is a financial metric. Attackers have noticed. They increasingly target backup infrastructure during ransomware attacks, which can leave an organization with fewer ways out.
If backups are compromised, recovery may require forensic investigations, incident response specialists, system rebuilds, new software and significant internal IT resources.
Backups versus recovery
Here’s what it means in plain terms. A backup tells you a copy of your data exists. A tested recovery strategy tells you how quickly you can turn that copy into a functioning business.
Even when backups exist, they only help if they are clean, accessible and recoverable. Datto BCDR is built to shrink that recovery window by capturing snapshots of entire systems — files, operating systems, applications and settings — at intervals as short as five minutes.
When an attack hits, affected systems can be virtualized on the backup appliance or in the Datto Cloud while the compromised environment is isolated, so the business can resume critical operations while IT investigates. Datto also offers an RTO & Downtime Cost Calculator to help businesses and managed service providers quantify their exposure and build a case for investing in resilience. The practical upshot: a mature BCDR strategy cannot necessarily stop a ransomware attack.
What it can do is cut the time a business stays disrupted, limit how messy the recovery gets, and shrink the bill that follows. For mid-market firms weighing where to spend their security dollars, that is the number worth watching.
