Sophos, a global leader in innovative security solutions, today released its State of Ransomware 2025 Report, revealing five significant findings about the evolving landscape of ransomware attacks. The report indicates that nearly 50% of companies paid the ransom to recover their data, marking the second-highest rate of ransom payment in six years.
This year’s report is the sixth edition of Sophos’ vendor-agnostic survey, which gathers insights from IT and cybersecurity leaders across 17 countries to understand the impact of ransomware on businesses.
Five Key Findings:
- More Companies are Stopping Attacks in Progress: 44% of companies were able to halt ransomware attacks before data encryption, a six-year high. Consequently, data encryption was at a six-year low, affecting only half of the victimized companies.
- Backup Use is Down: Only 54% of companies used backups to restore their data, the lowest percentage in six years.
- Ransomware Payments and Recovery Costs are Declining: The average cost of recovery dropped from $2.73 million in 2024 to $1.53 million in 2025. Ransom payments also declined by 50%, from $2 million in 2024 to $1 million in 2025.
- Ransom Payments Vary by Industry: State and local governments reported paying the highest median amount ($2.5 million), while the healthcare sector reported the lowest ($150,000).
- Companies are Recovering Faster: Over half (53%) of organizations fully recovered from a ransomware attack within a week, a significant increase from 35% last year. Only 18% took more than a month to recover, down from 34% in 2024.
Despite the high percentage of companies paying ransoms, over half—53%—paid less than the original demand. In 71% of these cases, companies achieved a lower payment through negotiation, either independently or with third-party assistance. The report highlights a positive trend: while the median ransom demand decreased by a third between 2024 and 2025, the median ransom payment dropped by 50%, demonstrating increased success in minimizing the financial impact of ransomware.
Overall, the median ransom payment was one million dollars, though initial demands varied significantly based on organization size and revenue. Companies with over $1 billion in revenue faced a median ransom demand of five million dollars, while organizations with $250 million or less in revenue saw median demands below $350,000.
For the third consecutive year, exploited vulnerabilities were identified as the primary technical root cause of attacks. A staggering 40% of ransomware victims reported that adversaries exploited security gaps they were unaware of, underscoring the ongoing challenge organizations face in maintaining visibility and securing their attack surface. Furthermore, 63% of organizations attributed their vulnerability to resourcing issues, with a lack of expertise cited as the top operational cause in larger organizations (over 3,000 employees) and insufficient staffing in those with 251-500 employees.
“For many organizations, the chance of being compromised by ransomware actors is just a part of doing business in 2025. The good news is that, thanks to this increased awareness, many companies are arming themselves with resources to limit damage. This includes hiring incident responders who can not only lower ransom payments but also speed up recovery and even stop attacks in progress,” says Chester Wisniewski, director, field CISO, Sophos.
Wisniewski also emphasized that ransomware can be mitigated by addressing its root causes: exploited vulnerabilities, limited visibility into the attack surface, and inadequate resources. He noted a growing trend of companies seeking assistance through Managed Detection and Response (MDR) services for defense. “MDR coupled with proactive security strategies, such as multifactor authentication and patching, can go a long way in preventing ransomware from the start,” he added.
Meanwhile, Sophos has recommended the following best practices for organizations to defend against ransomware and other cyberattacks:
- Eliminate common technical and operational root causes, such as exploited vulnerabilities. Tools like Sophos Managed Risk can help companies assess and minimize their exposure.
- Ensure all endpoints, including servers, are well-defended with dedicated anti-ransomware protection.
- Implement and regularly test an incident response plan. Maintain good backups and practice data restoration frequently.
- Secure around-the-clock monitoring and detection. If in-house resources are insufficient, consider partnering with a trusted managed detection and response (MDR) provider.
The State of Ransomware 2025 report is based on a vendor-agnostic survey of 3,400 IT and cybersecurity leaders from organizations with 100 to 5,000 employees across 17 countries that experienced ransomware attacks in the past year. The survey was conducted between January and March 2025, focusing on their ransomware experiences over the preceding 12 months. Sophos plans to release additional industry-specific findings throughout the year.