Cyberstats

Security Intelligence

Sophos

Cybersecurity reports and statistics published by Sophos

8 categories2 reports

Research Reports

Reports and publications from Sophos

State of Ransomware in Retail

The State of Ransomware 2025

Recent Statistics & Reports

46% of retail ransomware incidents were traced to an unknown security gap in 2025

Ransomware Security gap Retail

The average cost of recovering from a ransomware attack in retail, excluding any ransom payment, dropped by 40% to $1.65 million in 2025, the lowest point in three years

Ransomware Ransom Retail

62% of retailers who experienced attacks restored their data using backups in 2025, the lowest rate in four years

Ransomware Encrypted data Backup

47% of retail IT/cybersecurity teams reported increased pressure after experiencing data encryption in 2025

Ransomware Data encryption Retail

The median ransom demand for retail ransomware attacks doubled to $2 million in 2025 compared to 2024

Ransomware Ransom Retail

The proportion of retailers hit by extortion-only attacks tripled from 2% in 2023 to 6% in 2025

Ransomware Extortion-only attack Retail

58% of retail organizations with encrypted data paid the ransom in 2025, marking the second highest payment rate in five years

Ransomware Encrypted data Ransom

26% of cases in retail saw leadership teams replaced as a result of data encryption in 2025

Ransomware Leadership Retail

Overall, 63% of organisations cited resourcing issues as a contributing factor to falling victim to a ransomwre attack.

Over half (53%) of organisations fully recovered from a ransomware attack in a week, up from 35% last year.

Ransomware Recovery

Only 18% took more than a month to recover from a ransomware attack, down from 34% in 2024

Ransomware Recovery

Nearly 50% of companies paid a ransom to recover their data, which is the second highest rate of ransom payment for demands in six years.

Ransomware Ransom

Healthcare reported the lowest median ransom payment at $150,000.

Ransomware Ransom Healthcare

44% of companies were able to stop the ransomware attack before data was encrypted, marking a six-year high.

Ransomware Data encryption

Data encryption was at a six-year low, with only half of companies having their data encrypted in a ransomware attack.

Ransomware Data encryption

The median ransom payment was $1 million.

Ransomware Ransom

Companies with over $1 billion in revenue faced a median ransom demand of $5 million.

Ransomware Ransom

Lack of people/capacity was most frequently cited factor for falling for a ransomware attack by those with 251-500 employees.

Ransomware Talent Staff

The average cost of recovery from a ransomware attack dropped from $2.73 million in 2024 to $1.53 million in 2025.

Ransomware Cost

The median ransom demand decreased by a third between 2024 and 2025.

Ransomware Ransom

Showing first 20 results

Top Categories

8

Data encryption

3

2

2

2

Vulnerabilities

Related Vendors

Rubrik Zero Labs