Two numbers explain ransomware economics better than any headline. The median ransom payment was $139,875, according to Verizon’s 2026 Data Breach Investigations Report. The average total cost of a ransomware incident was $5.08 million, per IBM’s Cost of a Data Breach Report 2025. The ransom, in other words, is the cheap part. Think of a house fire where the match costs a nickel and the rebuild costs the block.
IBM’s figure is the highest it has recorded since it began tracking ransomware as its own breach type, and $640,000 above the overall average breach cost of $4.44 million. It counts detection, escalation, notification, response, regulatory fines, legal fees and business disruption.
Recovery is a separate bill
Sophos measures something narrower: what it costs to get back up, ransom excluded. Across 3,400 organizations in 17 countries, the mean fell 44% in 2025 to $1.53 million, from $2.73 million the year before. Sophos credits faster recovery. Some 53% of victims recovered within a week, up from 35% in 2024.
The picture is less rosy at the edges. The share of enterprise attacks stopped before encryption rose from 22% in 2023 to 47% in 2025, so the incidents that do reach recovery are, on average, milder. Marcus Chen of Axis Intelligence Research put it this way: “The mean has improved; the tail risk has not.”
Size matters. Companies with 100 to 250 employees paid a mean $638,536 in recovery alone, while those with 1,000 to 5,000 averaged $1.83 million, according to Sophos. Neither number includes the ransom. For a small firm, $638,536 can be weeks of operating cash. Mastercard’s global study of small businesses found nearly one in five that suffered a cyberattack filed for bankruptcy or closed for good.
Backups decide the outcome
Here’s what it means in plain terms: intact backups are the biggest lever a company has. Sophos research found that organizations with compromised backups faced a median recovery cost of roughly $3 million, against $375,000 for those with intact ones. That is about eight times higher.
Attackers know it. Veeam’s 2024 report found that 96% of ransomware attacks target backup repositories, and 76% of those attempts succeed.
Confidence runs ahead of results. In Veeam’s 2026 survey of more than 900 senior IT and security leaders, 90% said they were confident they could recover, yet only 28% of ransomware victims fully restored all affected data.
Healthcare pays most
Sophos puts healthcare recovery at a mean $1.02 million, down 60% year on year. IBM puts total healthcare breach costs at $7.42 million, the highest of any industry for the 14th straight year, though down from $9.77 million in 2024. The gap, about $6.25 million by Axis Intelligence’s calculation, is regulatory, notification and disruption cost that recovery figures miss.
The Change Healthcare attack sits at the far end. The Department of Health and Human Services confirmed it affected about 192.7 million people, and UnitedHealth Group’s total cost has been publicly estimated at more than $22 billion.
