In 2020, victims paid on average 37.4% of the initial ransom demand.

Average initial ransom demand (based on all cases with ransom demand) in 2023: $32.25 million.

Average initial ransom demand (based on all cases with ransom demand) in 2022: $21.46 million.

66% of CISOs say they would consider paying a ransom to prevent data leaks or restore systems. This figure rises to 84% in Canada and Mexico.

24% of UK organisations have a formal policy never to pay a ransom. This figure is double the figure from 2023

UK organisations are now more than three times more likely to recover from backups than pay the ransom.

17% of UK organisations hit by ransomware in the past year paid the ransom. This figure is down from 27% in 2024 and 44% in 2023.

32% of ransomware victims paid the attackers to recover or restore data.

41% of those who paid a ransom failed to recover all their data.

37% of organisations affected twice or more by ransomware paid the attackers.

Ransomware attackers have a one-in-three chance of payout.

A third (33%) of UK business leaders believe that a ban would decrease the prevalence of ransomware attacks by reducing the incentive for attackers.

94% of UK business leaders support limiting ransom payments for public entities.

99% of UK business leaders support limiting ransom payments for private organisations.

In real-world situations within the private sector, if a ransom payment ban were to take hold, 15% of UK business leaders said they would be neither likely nor unlikely to comply with such a ban.

Almost all UK respondents (98%) stated that cyber readiness and recovery will be a top spending priority.

75% of UK business leaders who believe ransomware payments should be banned admit they would still pay a ransom if it were the only way to save their organisation, even if a ban was extended to the private sector and civil or criminal penalties applied.

Just 17% of UK organisations paid the ransom following a ransomware attack.

In real-world situations within the private sector, if a ransom payment ban were to take hold, only 10% of UK business leaders said they would comply if they were attacked.

63% of organisations opted not to pay ransom demands last year, compared to 59% the year prior.