The percentage of companies admitting they were victimized by a ransomware attack ticked higher in 2025, according to research from consulting company, the CyberEdge Group. More companies are paying the ransom than in the past too, even though an estimated 39 to 40 per cent won’t get their data back after paying.
The annual Cyber Threat Defence Report from CyberEdge summarizes interviews with 1,200 security professionals from 17 countries and 19 different industries. Steve Piper, founder and CEO of CyberEdge says every year the organization asks if companies have been victimized by ransomware, if they paid the ransom, and if they did, whether they got their data back.
“There’s two pieces of bad news,” he told those gathered at a recent ISC2 Knowledge Vault webinar for cybersecurity professionals. “The percentage of organizations that were victimized by a successful ransomware attack ticked up a little bit, to 64 per cent.” He also adds that following three consecutive years of declines, the number of companies paying a ransom were also moving back in the opposite direction in 2025. “More than half of organizations actually do pay ransoms,” he says.
Encryption attacks
In the presentation, he discusses the different attacks, noting that encryption attacks are declining while data theft attacks are trending upwards. The average ransom demand being reported by Codeware, a cybersecurity consulting company, he says is up 176 per cent to $1.9 million, quarter-over-quarter, in 2026. (Figures in U.S. dollars.)
Piper emphasized in the presentation that companies of all sizes are affected, although he does note that a disproportionate number of smaller companies would appear to be affected.
“Consult with experts,” he encouraged those inquiring about strategies for smaller companies. “Contact them before you’re compromised. Hear them out. Just learn. Talk to them. Because when the day comes, you need to be prepared.”
He also encouraged those gathered to discuss their organizations with cybersecurity insurers, as well. “There are reasons why ransom payments may not be covered by cyber insurance policies,” he explains. “Don’t assume that they do.”
He also discusses processes companies go through when a ransomware attack occurs and the risks of paying versus not paying a ransom (bad publicity, lawsuit potential, becoming a target for repeat attacks). His repeating message? Companies need to specifically prepare for such an attack ahead of time, particularly given the high numbers of those already successfully targeted.
“I want to convince all of you to be prepared for a ransomware attack,” he told those gathered for the webinar. “Don’t go through this when you’re looking at a countdown timer; go through this in advance when you can make calm, rational decisions,” he adds. “Once you’re victimized, that countdown clock starts.”
Piper’s recommendations include:
- Put together a decision tree, ahead of time, based on the business criticality of each system and the potential financial impact of having the system offline. Consult legal, insurance carriers, key stakeholders, communications and executives, all, while preparing.
- As part of planning, create a ransomware contact list including the company’s incident response team, legal department, law enforcement, insurance carriers, executives and corporate communications. “Figure it out ahead of time,” he urges, “so that they can be contacted immediately.”
- Engage third-party ransomware experts ahead of time. “I recommend contracting with a ransomware response vendor to have on standby,” he says. “There are lots of companies on the list. Do your due diligence now.”
- Invest in human training, at least annually, as 30 per cent of ransomware attacks begin in phishing and social engineering efforts. “Too many organisations aren’t doing anything,” he says. “At the very least have new employee onboarding training and send someone down from the IT department to scare the hell out of everybody. I mean literally.”
- Examine endpoint and network deception techniques. “It’s a great way to detect people wandering around your network, when they shouldn’t be,” he says. “Invest in technologies to prevent lateral movement, that East-West traffic after they’re already in. This is where zero trust also comes into play. Micro segmentation, multi-factor authentication. Privileged access management is fantastic. Monitor the use of privileged credentials.”
- Know your daily cost of downtime. “Figure that out,” he says. “It’s helpful to know your cost of downtime ahead of time.”
