Ransomware Recovery Costs Hit $1.7M as Data Theft Surges 275%

The ransom is now the smaller bill

When ransomware hits a company, most of the attention goes to the ransom demand. The 2026 numbers suggest that focus is in the wrong place. The ransom payment is shrinking. The costs of cleaning up, rebuilding and dealing with stolen data are growing. These attacks now look less like hostage situations and more like data breaches that leave a large rebuilding bill behind.

Sophos's seventh annual State of Ransomware report surveyed 2,158 IT and security leaders in 17 countries. It found that the average cost of recovering from an attack rose 11% to $1.7 million, and that figure excludes any ransom paid.1415 Over the same period, the median ransom payment fell from $1 million to $769,000, and the median demand dropped to $698,000.14 Among organizations that paid, 51% talked the attackers down below their opening demand.15 Analysts have summed up the gap this way: a ransom can be negotiated, but a recovery cannot.16

October's incident reports show what that recovery looks like in practice. Svedala, a Swedish municipality, saw all of its IT systems go down and moved into crisis mode while it worked out how far the attackers had gotten and whether data had been taken.29 Vicksburg, Mississippi temporarily shut down its city computer systems, though police, fire and 911 services kept running.29 At Osaka Metropolitan University in Japan, about 500 servers went offline, classes were canceled, and data on at least 130,000 students and staff may have been exposed.29

The first day: containment, not restoration

Incident responders tend to describe the first 24 hours the same way. The priority is figuring out what happened and stopping it from spreading, not getting data back. Data recovery firm Ontrack says the job in the first hour is to isolate infected machines, shut down network ports or VPN access where needed, and avoid touching anything unnecessary, because hasty fixes can destroy evidence forensic teams need later.1 If Active Directory, the system that manages user accounts and permissions, appears compromised, a company-wide password reset usually follows.1

Insurance adds pressure early. Many cyber policies set deadlines for reporting an incident and come with a list of approved response vendors. A company that brings in its own forensic team before checking with its insurer can run into coverage disputes later.1 IT services firm DXC makes a similar point: forensic teams have to meet insurers' documentation requirements, and senior leaders should start tracking incident costs from the beginning.9

Most sources agree on what comes next. Investigators work out how the attackers got in, what they touched, and whether data left the network before it was encrypted.19 That last question now often decides how bad the aftermath will be.

Stolen data is the real long-term damage

The biggest change in 2026 is the move from locking files to stealing them. Zscaler's ThreatLabz 2026 Ransomware Report found that leading groups exfiltrated 896.2 terabytes, up 275.8% from the prior year and more than seven times the 2023–2024 total.22 The largest single claims were huge. Babuk2 claimed 30 TB from a government organization, INC Ransom claimed 20 TB from a large healthcare organization, and a newer group called Pear claimed 16 TB from a U.S. university.2230

The same report includes a case that changes the usual definition of a ransomware attack. Attackers got in through spam bombing and by posing as IT staff, then demanded payment without encrypting anything. The victim paid $2 million even though none of its files were ever locked.22 Once attackers hold sensitive data, a restore from backup doesn't take away their leverage.

That is why the legal and disclosure work after an attack can matter as much as getting systems back online.1 Ontrack notes that many groups now steal data first and encrypt second, and that the resulting notification duties weigh heavily on victims.1 Graybar Electric shows how quickly a stolen-data claim becomes a legal problem. A group called Redact claimed the attack on October 1, reportedly involving 606 GB. By October 7, a searchable index of about 3.6 million rows of allegedly exposed records had been published, and lawyers had started looking into a possible class action.23 The breach was still unconfirmed when that investigation was announced. Advantest, by contrast, said plainly in its October 6 notice that data had been taken.27

Security firm UpGuard describes the final stage, the full data dump, as worse than a sale to a single buyer. Data posted openly on forums or Telegram channels stays available indefinitely. Leaked employee passwords also let later attackers skip the break-in stage entirely.4

Paying doesn't guarantee recovery

The sources agree that paying is a poor bet. They disagree on how poor, and the gap is wide. ExtraHop cites a Sophos finding that only 4% of organizations that paid got all their data back.2 DXC puts average restoration after payment at about 65% of data.9 CrowdStrike says fewer than half of ransomware victims manage to restore their systems.5 Decryptors can fail in several ways. Victims may receive more than one key, a faulty tool, software that doesn't run on their operating system, or a key that unlocks only one of two layers of encryption.5 DXC adds that decrypting a single system can take more than 24 hours.9

The differences come from different samples and different definitions of "recovered," but they point the same way. Payment buys some chance of speed. It doesn't guarantee getting your data back. The UK's National Cyber Security Centre adds that paying leaves the computer still infected, funds criminal groups, and makes the victim more likely to be targeted again.7

On repeat attacks the sources also agree on direction while differing on numbers. ExtraHop says 85% of ransomware victims are attacked again.2 An ISACA white paper cites a study finding that 80% of companies that paid were hit a second time, 40% paid again, and 70% of those paid more the second time.10 Victims appear to be willing payers in the attackers' eyes. This is analysis rather than proof, but it is consistent with the falling share of victims who pay. Coveware's Q2 2026 data shows payment rates at a record low, with only 15% of victims in theft-only cases paying.11 IBM reports that 63% of ransomware victims refused to pay, up from 59%.11

Why the cost figures don't match

Different reports describe the same attacks with very different numbers. IBM's Cost of a Data Breach research puts the average total cost of a ransomware incident at $5.08 million once downtime, legal work and business disruption are included.12 Sophos's $1.7 million covers recovery operations only. One analysis explains the gap: IBM counts notification, regulatory fines and legal fees, which Sophos leaves out.18

Ransom figures vary even more. Coveware's Q2 2026 median payment was $150,000, against Sophos's $769,000, and a handful of very large law-firm settlements pulled Coveware's average up to about $1.88 million.11 Verizon's 2026 DBIR reports a median of $139,875.18 The likely explanation is sampling. Sophos surveys organizations weighted toward larger enterprises, while Coveware draws on cases it handled directly.11 Readers should treat any single number as a benchmark, not a forecast.13

Downtime is the factor that varies most. Estimates run from about $300,000 an hour for large enterprises to roughly $1.9 million a day in manufacturing.12 The median outage lasts about a week, but the mean is closer to 24 days.12 DXC's experience is that restoring production after a major attack takes one to three weeks, followed by up to a year of further recovery and security work.9 Hospitals show the human side of these numbers. A 2026 study found that ransomware cut hospital patient volume by 17% to 24% in the first week, with activity recovering within three weeks.13

Backups help, but they don't end the outage

Backups remain the biggest single factor in how fast a company recovers, and attackers know it. In 2026, 66% of organizations whose data was encrypted used backups to recover, up from 54% the year before.1719 Yet recovery costs still went up. Teams have to work out which data predates the break-in, check that systems are clean, and restore the services other applications depend on. Each unresolved dependency can stretch the outage.17 Attackers also go after backups directly. CYFIRMA's analysis of a new strain called RIED found it deleting shadow copies and backup catalogs, which are the files and records a company would otherwise use to restore.24 Ontrack reports that even damaged tape libraries and partly encrypted storage can sometimes be recovered, though the work is slow.1

The main lesson from this year's coverage is that the aftermath of a ransomware attack has two parts. One is the rebuild. The other is a data breach that lasts long after systems are back online. The data dumps continue: one tracker logged dozens of new leak-site victims in the first week of October alone.21 The organizations that come through best are likely to be those that limit what attackers can steal, keep backups that attackers can't reach, and rebuild more securely instead of simply restoring the old setup. DXC warns that a rebuild without those improvements leaves a company just as exposed to the next attack.9