The State ofRansomware 2023
Findings from an independent, vendor-agnostic surveyof 3,000 leaders responsible for IT/cybersecurity across
14 countries, conducted in January-March 2023.

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Introduction
Sophos’ annual study of the real-world ransomware experiences of IT/cybersecurity
leaders makes clear the realities facing organizations in 2023. It reveals the mostcommon root causes of attacks and shines new light on how experiences withransomware differ based on organization revenue. The report also reveals thebusiness and operational impact of paying the ransom to recover data rather thanusing backups.

About the Survey
Sophos commissioned an independent, vendor-agnostic survey of 3,000 IT/
cybersecurity leaders in organizations with between 100 and 5,000 employees
across 14 countries in the Americas, EMEA, and Asia Pacific. The survey was
conducted between January and March 2023, and respondents were asked torespond based on their experiences over the previous year.
Within the education sector, respondents were split into lower education (catering
to students up to 18 years) and higher education (for students over 18 years).

	3,000

respondents

14countries

100-5,000

	employee organizations

Jan-Mar 2023
research conducted<$10M - $5B+
annual revenue

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Contents
Introduction .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 2Rate of Ransomware Attacks .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  4
Root Causes of Ransomware Attacks .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  6
Rate of Data Encryption  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 8Data Theft  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 9Data Recovery .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  9
The Impact of Cyber Insurance on Data Recovery .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .11Ransom Payments .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  12
Recovery Costs  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .14Recovery Cost by Revenue .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .15Business Impact  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  16
Loss of Business/Revenue by Industry .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .17Recovery Time  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 18
Conclusion .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  19
Additional Charts  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  20
Research Methodology  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  26

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Rate of Ransomware Attacks

Attacks by Industry

The research revealed that the rate of ransomware attacks has remainedlevel, with 66% of respondents reporting that their organization was hit byransomware in the previous year, the same as in our 2022 survey. With
adversaries now able to consistently execute attacks at scale, ransomware isarguably the biggest cyber risk facing organizations today.

The education sector was the most likely to have experienced a ransomware attackin the last year with 80% (lower education) and 79% (higher education) reporting
being hit. Education traditionally struggles with lower levels of resourcing andtechnology than many other industries, and the data shows that adversaries are
exploiting these weaknesses.

Cyber criminals have been developing and refining the ransomware-as-aservice model for several years. This operating model lowers the barrier to entry
for would-be ransomware actors while also increasing attack sophistication
by enabling adversaries to specialize in different stages of an attack. For more
information on ransomware-as-a-service, read the Sophos 2023 Threat Report.

IT, technology, and telecoms reported the lowest level of attack (50%), indicating ahigher level of cyber readiness and cyber defenses.

2020

2021

2022

2023

51%

37%

66%

66%

In the last year, has your organization been hit by ransomware?
Yes. n=3000 (2023), 5,600 (2022), 5,400 (2021), 5,000 (2020)

Attacks by Country
While the overall reported ransomware rate remains flat compared to 2022, thesurvey revealed variations at a country level. Singapore reported the highest
rate of ransomware attacks in this year’s study, with 84% of organizations being
hit in the previous year. Conversely, the UK reported the lowest rate of attack(44%).
Austria reported the biggest drop in rate of attack, down from 84% oforganizations hit to 50%. South Africa had the biggest increase in attack rate,with 78% of organizations hit in our 2023 survey compared to 51% in 2022.
For further details, see Rate of Ransomware Attacks by Country: 2022 vs 2023
on page 20.

A Sophos Whitepaper. May 2023

For further details, see Rate of Ransomware Attacks by Industry on page 21.

66% hit by ransomware
Singapore highest rate of attack (country)
UK lowest level of attack (country)
Education highest level of attack (industry)
IT, Technology, and Telecoms lowest level of attack(industry)

The State of Ransomware 2023

Attacks by Organization Size: Employees vs. Revenue

Percentage of Organizations Hit by Ransomware by Revenue

The research revealed a clear correlation between annual revenue andpropensity to experience a ransomware attack, with the percentage oforganizations hit by ransomware increasing progressively with revenue. 56%
of organizations with revenue of $10-$50 million experienced a ransomware
attack in the last year, rising to 72% of those with revenue of $5 billion plus.
Conversely, there was little clear relationship between experiencing
ransomware and the number of employees in an organization. Outside the1,001-3,000 employee segment, the rate of ransomware attack was very
consistent:
Ì 100-250 employees62%Ì 251-500 employees62%Ì 501-1,000 employees62%Ì 1,001 – 3,000 employees73%Ì 3,001 – 5,000 employees

63%

The data makes clear that in the context of organization size, annual revenue isa much greater indicator of likelihood of experiencing an attack than number of
employees.

63%
58%

67%

67%

72%

56%

Less than $10 - $50 $50 - $250
millionmillion$10(n=241)(n=674)
million(n=106)$250 $500
million(n=430)$1 billion $5 billion
$500
plus
million to $5 billion(n=469)to $1 billion (n=447)(n=633)In the last year, has your organization been hit by ransomware? Yes. Base numbers in chart

A Sophos Whitepaper. May 2023

69%

The State of Ransomware 2023

Root Causes of Ransomware Attacks

Root Causes by Industry

Survey respondents reported that an exploited vulnerability was the mostcommon root cause of ransomware attacks (36%), followed by compromised
credentials (29%). These findings align almost exactly with Sophos’ latest
retrospective analysis of 152 attacks that our Incident Response and Managed
Detection and Response (MDR) teams were brought in to remediate, where 37%
started with an exploited vulnerability and 30% with compromised credentials.

The media, leisure, and entertainment sector reported the highest percentage
of attacks where the root cause was an exploited vulnerability (55%), indicatingwidespread security gaps in this area. Central and federal government had thehighest percentage of attacks that started with compromised credentials (41%).
This may be due to a higher rate of credential theft in this sector, a lower ability toprevent exploitation of stolen credentials, or a combination of the two.

Emails were the root cause of 30% (with rounding) of attacks: 18% started with amalicious email and 13% with phishing. 3% began with a brute force attack andjust 1% with a download.

IT, technology, and telecoms reported the lowest rates for both exploitedvulnerabilities (22%) and compromised credentials (22%), which likely reflects
strong levels of cyber defenses in this sector. However, it did report the highest
rates of email-based attacks, with over half (51%) starting in users’ inboxes.

36%

29%

18%

Exploited
Vulnerability

Compromised
Credentials

Malicious Email

13%

3%

1%

Phishing

Brute Force
AttackDownloadDo you know the root cause of the ransomware attack your organization experienced in the last year? If you were hit
more than once, think about the most significant attack. (n=1,974 organizations hit by ransomware in the last year)

A Sophos Whitepaper. May 2023

For further details see Root Causes of Attacks by Industry on page 22.

The State of Ransomware 2023

Root Causes by Revenue
cohorts, dipping down to 30% in the middle cohort ($250 - $500 million).
Conversely, the use of compromised credentials peaks in the middle revenue
cohort (33%), while the lowest usage was reported in the lowest (23%) andhighest (26%) revenue cohorts.

Analyzing the root causes by annual revenue reveals that exploited vulnerabilities
and compromised credentials follow opposing propensity curves. The highest
percentages of attacks that started with an exploited vulnerability were reported by
the lowest (less than $10 million: 50%) and highest ($5 billion plus: 45%) revenue

50%
45%

36%

36%
32%

33%
31%

36%
32%

30%

29%
26%

24%

23%

21%

20%

19% 19%

16%

16%
13%

12%

11%

15%

13%

14%

15%

8%
3%

2%
Less than$10 million(n=62)$10 - $50
million(n=135)$50 - $250
million(n=426)4%

3%$250 - $500
million(n=286)$500 million
to $1 billion(n=422)

Annual Revenue
Exploited vulnerability

Compromised credentials

Malicious email

Phishing

Do you know the root cause of the ransomware attack your organization experienced in the last year? Selection of answer options. Base numbers in chart

A Sophos Whitepaper. May 2023

4%2%Brute force attack$1 billion
to $5 billion(n=307)$5 billion
plus(n=336)

The State of Ransomware 2023

Rate of Data Encryption

Data Encryption by Industry

Data encryption has continued to rise, with adversaries succeeding in encrypting
data in over three quarters (76%) of ransomware attacks. In fact, encryption
levels are now at their highest point in the last four years. This likely reflects theever-increasing skill level of adversaries who continue to innovate and refine theirapproaches.

Almost all sectors struggle to stop attacks before data can be encrypted: withjust one exception, in every sector, over two thirds of attacks resulted in dataencryption. The highest frequency of data encryption (92%) was reported bybusiness and professional services.

Did the cybercriminals succeed in encrypting your organization’s
data in the ransomware attack?
76%

73%
65%
54%

39%
31%
24%

21%
7%

3%
2020
(n=2,538)2021(n=2,006)

4%2022(n=3,702)

3%
2023(n=1,974)

No – Data was not encrypted but we were still held to ransom (extortion)
No – The attack was stopped before data was encrypted
Yes – Data was encrypted

A Sophos Whitepaper. May 2023

IT, technology, and telecoms is the sector that bucks the trend, with adversaries
succeeding in encrypting data in fewer than half (47%) of attacks. This is anotherindicator of the high level of cyber defenses and response preparation by this
sector.
For further details see Data Encryption by Industry on page 23.

The State of Ransomware 2023

Data Theft

Data Recovery

In 30% of attacks where data was encrypted, data was also stolen. This “double
dip” approach by adversaries is becoming increasingly commonplace as theylook to increase their ability to monetize attacks. The threat of making stolen
data public can be used to extort payments and the data can also be sold. The
high frequency of data theft increases the importance of stopping attacks as
early as possible before information can be exfiltrated.

97% of organizations that had data encrypted got data back. Backups were the mostcommon approach, used in 70% of incidents. 46% paid the ransom and got data
back, while 2% used other means. Overall, one in five (21%) used multiple methods torestore their data. 1% of organizations that had data encrypted paid the ransom but
didn’t get data back.

30%

Use backups torestore data

Paid the ransomand got data backUse other means
to get data back

70%

46%

2%

Of ransomware attacks where data was encryptedreported that data was also stolen
Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack?
Yes; Yes, and the data was also stolen. n=1,497

Concerningly, use of backups to recover data has dropped in the last year when it wasused to recover data in 73% of cases. Ransom payment rate has remained level fromlast year.
73%
56%

26%

2020
(n=1,849)

70%

57%
46%

46%

2022
(n=2,398)2023(n=1,497)

32%

2021
(n=1,086)

Paid the ransom and got data backUsed backups to restore the data

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore the data.
Base numbers in chart

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Data Recovery by Country

Ransom Payment and Backup Use by Revenue

Overall, respondents in EMEA reported higher aggregate levels of backup use (75%)
and lower aggregate levels of ransom payments (40%) than those in the Americas(65%/55%) and Asia Pacific (67%/49%). At a country level, France has the highest
level of backup use (87%), closely followed by Switzerland (84%).

Generally speaking, as annual revenue increases, so does the propensity of anorganization to recover data by paying the ransom. At the same time, frequency of
backup use drops.

The importance of backups is demonstrated when we see that the two countries
least able to use backups to restore data, Italy (55%) and Singapore (57%), are also
the two countries that reported the lowest overall data recovery rates (93% and 90%,
respectively). Italy also reported the highest propensity to pay the ransom (56%),
closely followed by the U.S. and Brazil (both 55%).
In most cases, organizations that paid the ransom were able to recover data.
However, in France and the UK, around one in ten organizations that paid theransom did not get any data back.

Of the organizations with revenue of over $5 billion, 55% got data back by paying
the ransom and 63% used backups. At the same time, 36% of organizations withrevenue of less than $10 million recovered data by paying the ransom, while 80%
used backups – the highest rate of backup use of all revenue cohorts.
Organizations with lower annual revenue have less money to fund ransom
payments, forcing them to focus on backups for data recovery. At the same time,larger revenue organizations typically have complex IT infrastructures which may
make it harder for them to use backups to recover data in a timely fashion. They arealso the businesses most able to buy their way out of such situations.

For further details see Data recovery by Country on page 24.

Ransom Payment and Backup Use by Revenue

80%

77%

75%

72%

68%

51%
41%

36%

< $10 million(n=45)

66%
52%

63%
55%

42%
33%

$10 - $50 million(n=96)

Paid the ransom and got data back

$50 - $250 million(n=324)$250 - $500 million(n=212)$500 million to $1
billion (n=333)

Used backups to restore the data

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore the data. Base numbers in chart

A Sophos Whitepaper. May 2023

$1 billion to $5
billion (n=216)$5 billion plus
(n=271)

The State of Ransomware 2023

The Impact of Cyber Insurance on Data
Recovery
Organizations with cyber insurance were considerably more likely to recoverencrypted data than those without such policies. However, the type of cyber coverage
made very little difference: 98% of those with a standalone policy and 97% of thosewith a wider insurance policy that covers cyber got data back. In comparison, 84% of
those without a policy were able to get encrypted data back.
Percentage of ransomware victims that recovered encrypted data

98%

97%

84%

With a standalone
cyber policy

With a wider
insurance policythat includes cyberWithout acyber policy

Did your organization get any data back? n=1,497 organizations that were hit by ransomware in the last year and had dataencrypted

There are likely several factors behind this variance. First, cyber insurance typicallyrequires organizations to have backups and recovery plans as conditions of coverage.
Insurers are also able to guide ransomware victims through the recovery process inorder to optimize outcomes. Furthermore, organizations with cyber insurance are
more likely to pay the ransom to recover data than those without a policy.
Impact of insurance on propensity to pay ransom

Standalone
cyber policy

Wider insurance
policy that
includes cyber

No cyber policy

58%

36%

15%

paid the ransom

paid the ransom

paid the ransom

Did your organization get any data back? Yes, we paid the ransom and got data back. n=1,497 organizations that were hit byransomware in the last year and had data encrypted (771 standalone policy, 658 cyber as part of wider policy, 67 no cyberpolicy)A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Ransom Payments
The study revealed a wide distribution of payments, however the proportion oforganizations paying higher ransoms has increased from our 2022 study, with 40%
reporting payments of $1 million or more compared to 11% last year. Conversely, just
34% paid less than $100,000, down from 54% last year.

While overall propensity to pay ransom remains level with last year’s study, thepayments themselves have increased considerably over the last year, with theaverage (mean) ransom payment almost doubling from $812,380 in 2022 to$1,542,333 in 2023. The median ransom payment reported in this year's study
was $400,000.

Ransom Payments: 2023 vs 2022
27%

17%
14%
11%

9%
5%
4%

Less than$1,000

5%

6%

8%

13%

13%

12%
10%

10%

7%

6% 6%

6%

7%
4%

2%

Between$1,000 and$4,999.99

2022 (n=965)

Between$5,000 and$9,999.99

Between$10,000 and$19,999.99

Between$20,000 and$49,999.992023 (n=216)

How much was the ransom payment that was paid to the attackers? Excluding “Don’t know” responses.

A Sophos Whitepaper. May 2023

Between$50,000 and$99,999.99

Between$100,000
and$249,999.99

Between$250,000
and$499,999.99

Between$500,000
and$999,999.99

Between$1 million and$4,999,999.99$5 million
or moreThe State of Ransomware 2023

Ransom Payments by Revenue
Perhaps unsurprisingly, the largest revenue organizations were most likely to pay
the highest ransoms, reflecting that adversaries will adjust the amount they will
accept based on ability to pay. The study did not distinguish between payments
funded internally and those funded by insurance providers.
Interestingly, there was very little difference in both the mean and medianransom payments for organizations with $250 million - $500 million revenue
and those with $500 million - $1 billion revenue.

$50-$250
MILLION (N=37)$250-$500
MILLION (N=33)$500 MILLION TO$1 BILLION (N=72)$1 BILLION - $5
BILLION (N=45)$5 BILLION
PLUS (N=21)

Mean ransom
payment$690,996$1,523,652$1,466,240$2,049,817$2,464,339

Median ransom
payment$145,000$428,000$425,000$1,000,000$3,000,000

How much was the ransom payment that was paid to the attackers? Excluding “Don’t know” responses. Excludingorganizations with below $50 million annual revenue due to very low base numbers. Base numbers in chart. Data forsegments with fewer than 30 responses should be considered indicative only.

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Recovery Costs
Ransom payments are just one element of recovery costs when dealing withransomware events. Excluding any ransoms paid, organizations reported an estimatedmean cost to recover from ransomware attacks of $1.82 million, an increase from the2022 figure of $1.4 million and in line with the $1.85 million reported in 2021.
Note: the 2021 and 2022 study question wording included ransom payments in theestimated costs, but they were removed from the 2023 survey wording. As a result, theyear-on-year comparison should be considered indicative only.
Mean Recovery Cost

2021

2022

2023

$1.85M$1.4M$1.82M

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack (considering
downtime, people time, device cost, network cost, lost opportunity etc.)? n=1,974 (2023)/ 3,702 (2022)/ 2,006 (2021). N.B. 2022
and 2021 question wording also included “ransom payment”.

Mean reported recovery costs started at $165,520 for organizations with annual revenueof less than $10 million, rising to $4,496,086 in the $5 billion plus cohort. While thesenumbers mask a range of recovery costs, there is a clear pattern of recovery costs
increasing with revenue, as indicated in the chart on the following page.

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Recovery Cost by Revenue
35%

30%

25%

20%

15%

10%

5%

0%
< $10,000$10,000 $50,000

Less than $10 milliom (n=62)$500-$1 billion (n=422)$50,000 $100,000$100,000 $250,000$10-$50 million (n=135)$1 billion-$5 billion (n=307)$50-$250 million (n=426)$5 billion plus (n=336)

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack(considering downtime, people time, device cost, network cost, lost opportunity etc.)? Base numbers in chart

A Sophos Whitepaper. May 2023

$250,000 $500,000$500,000 $1 million$1M $5M$250-$500 million (n=286)$5M $10M$10M $15M

The State of Ransomware 2023

Recovery cost by data recovery method

Business Impact

Whichever way you look at the data, it is considerably cheaper to use backups torecover from a ransomware attack than to pay the ransom. The median recovery
cost for those that used backups ($375,000) is half the cost incurred by thosethat paid the ransom ($750,000). Similarly, the mean recovery cost is almost$1 million lower for those that used backups. If further evidence were needed of
the financial benefit of investing in a strong backup strategy, this is it.

84% of private sector organizations hit by ransomware reported that the attack
caused them to lose business/revenue. Annual revenue had a relatively small impact
on loss of business, with the lowest rate (79%) reported by the $250 million - $500
million cohort and the highest rate (88%) by those with less than $10 million andthose with more than $5 billion revenue.

Paid the ransom andgot data backUsed backups
to restore data

$750,000$375,000

medianmedian$2.6M$1.62Mmean

mean

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack(considering downtime, people time, device cost, network cost, lost opportunity etc.)? n=694 that paid the ransom andgot data back and 1,053 that used backups to restore the data.

A Sophos Whitepaper. May 2023

Industry type played a much greater role in propensity to lose business/revenue.
Overall, lower education (94%) and construction and property (93%) were most likely
to report some loss of business/revenue due to attacks and the manufacturing andproduction sector was least likely (77%).
Diving deeper, we see considerable variation in the sectors that reported losing “alot” of business/revenue, with business and professional services (64%) more than
five times more likely than IT, technology, and telecoms (12%) to have experienced
this level of impact.

The State of Ransomware 2023

Loss of Business/Revenue by Industry

68%
64%
60%

59%

47%

46%

43%
41%

47%
45%

46%

46%

42%

42%
39%

44%

44%

42% 42%

46%

38%
34%

32%

34%
31%

28%

27%

12%

Average(n=1523)

Business andprofessional
services (n=84)

Construction
and property(n=96)

Lost a lot of business/revenue

Distribution
and transport(n=92)

Lower
education(n=110)Highereducation(n=74)

Energy, oil/gas
and utilities(n=101)

Lost a little business/revenue

Did the ransomware attack cause your organization to lose business/revenue? Yes, we lost a lot of business/revenue;
Yes, we lost a little business/revenue. Private sector organizations that were hit by ransomware, base numbers in chart

A Sophos Whitepaper. May 2023

Financialservices(n=216)

Healthcare(n=73)

IT, technology
and telecoms(n=73)

Manufacturing
and production(n=205)Media, leisure,entertainment(n=96)

Retail(n=244)Other(n=59)

The State of Ransomware 2023

Recovery Time

Recovery time by data recovery method

While the time to recover from a ransomware attack is broadly in line with the2022 report, the percentage that were able to recover in less than a day has
dropped from 14% to 8%.

The research revealed that organizations that use backups to recover their data
recover from the attack more quickly than those that pay the ransom. 45% of
those that used backups recovered within a week, compared with 39% of thosethat paid the ransom. Almost one third (32%) of those that paid the ransom took
more than a month to recover, while the figure for those that used backups is 23%(with rounding). While these two response options were not mutually exclusive andsome respondents will have both paid the ransom and used backups, the recovery
advantages of backups are clear.

39% 39%

27%

29%

40%
33%

16% 18%

29%

14%
8%
4%

32%

21%

6%

19%
10%

Less than aday

Up to a week

2022 (n=3,702)

Up to 1 month

1-3 months

3-6 months

6% 5%

5%
0% 0%

2023 (n=1,974)

How long did it take your organization to fully recover from the ransomware attack? Base numbers in chart

Less thana day

Up to aweek

Up to
1 month1-3
months3-6monthsPaid the ransom and got data back (n=694)
Used backups to restore the data (n=1,053)
How long did it take your organization to fully recover from the ransomware attack?
Organizations that paid the ransom and/or used backups to recover data. Base numbers in chart

A Sophos Whitepaper. May 2023

Over 6monthsThe State of Ransomware 2023

Conclusion
Independent of revenue, geography, or industry, ransomware continues to be
major threat to organizations. As adversaries continue to hone their attack tactics,
techniques, and procedures (TTPs), defenders are struggling to keep pace, resulting
in increased encryption rates.
The drop in the use of backups to recover encrypted data is considerable cause forconcern. If further evidence was needed regarding the financial and operational
benefits of investing in a strong backup strategy, this report provides it.
With the growth of the ransomware-as-a-service business model, we do not
anticipate a drop in attacks in the coming year. Organizations should focus on:Ì Further strengthening their defensive shields with:
 Security tools that defend against the most common attack vectors,
including endpoint protection with strong anti-exploit capabilities
to prevent exploitation of vulnerabilities, and zero trust network
access (ZTNA) to thwart the abuse of compromised credentials
 Adaptive technologies that respond automatically to attacks,
disrupting adversaries and buying defenders time to respond 24/7 threat detection, investigation, and response, whetherdelivered in-house or in partnership with a specialist Managed
Detection and Response (MDR) service provider
Ì Optimizing attack preparation, including making regular
backups, practicing recovering data from backups, andmaintaining an up-to-date incident response planÌ Maintaining good security hygiene, including timely patching
and regularly reviewing security tool configurations

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Additional Charts
Rate of Ransomware Attacks by Country: 2022 vs. 2023
Percentage of Organizations Hit by Ransomware

84%

84%
80%

78%

78%
73%
70%

73%

68%

66% 66%

75%

71%

67%
61%

68%

65%

65%

64%
58%

75%

61%

60%

58%

57%

55%
50%

48%

51%
44%

Average(n=5,600/
3,000)

2022

Australia(n=250/200)

Austria(n=100)Brazil(n=200)France(n=200/150)

2023

In the last year, has your organization been hit by ransomware? Base numbers in chart

A Sophos Whitepaper. May 2023

Germany(n=400/300)

India(n=300)Italy(n=200)Japan(n=300)Singapore(n=150/100)

South Africa(n=200)Spain(n=150)

Switzerland(n=100)UK(n=300/200)

US(n=500)

The State of Ransomware 2023

Rate of Ransomware Attacks by Industry
Percentage of Organizations Hit by Ransomware

80%

79%
71%

66%

70%

70%

69%

69%

67%

67%

64%
60%

60%

58%

56%
50%

Average(n=3,000)

Lower
education(n=200)Highereducation(n=200)Construction
and property(n=136)

Central/Media,
Local /
leisure, enterState
Federalgovernment
tainment
government(n=140)(n=138)(n=255)In the last year, has your organization been hit by ransomware? Base numbers in chart

A Sophos Whitepaper. May 2023

Retail(n=355)

Energy,oil/gas andutilities(n=150)Distributionandtransport(n=137)

Financialservices(n=336)

Business
andprofessional
services(n=140)

Healthcare(n=233)Other(n=102)IT,
Manufacturing
technology
andproduction and telecoms(n=145)(n=363)

The State of Ransomware 2023

Root Cause of Attack by Industry
Business and prof. services (n=84)

49%

32%

Central/Federal government (n=98)

38%

41%

Construction and property (n=96)

27%

Distribution and transport (n=92)

38%

30%

Lower education (n=159)

29%

36%

Higher education (n=157)

40%

Energy, oil/gas and utilities (n=101)

35%

Financial services (n=2016)

40%

23%

19%

Healthcare (n=139)

29%

32%

22%

IT, technology and telecoms (n=73)

22%

Local/state government (n=155)

38%

Manufacturing & production (n=205)

24%

Media, leisure, entertainment (n=96)

55%

Retail (n=244)

41%

Other (n=59)

46%

Exploited vulnerability

Compromised credentials

10%

33%

24%
21%
19%

37%

12%

31%

22%

24%

30%
21%
25%
22%

15%
27%

Malicious email

Phishing

Brute force attack

6%

4%

15%

1%

10%

1%

11%

4%

7%

2%

7%

3%
3%

14%

11%

27%

5%

13%

30%

Do you know the root cause of the ransomware attack your organization experienced in the last year? Selection of answer options. Base numbers in chart

A Sophos Whitepaper. May 2023

14%

10%

Download

1%

21%

1%

14%

5%

20%

5%

13%

2% 4%

17%

2%
15%

2%

The State of Ransomware 2023

Data Encryption by Industry
Business and prof. services (n=84)

92%

8%

Central/Federal government (n=98)

84%

16%

Construction and property (n=96)

85%

15%

Distribution and transport (n=92)

77%

23%

Lower education (n=159)

81%

19%

Higher education (n=157)

73%

27%

Energy, oil/gas and utilities (n=101)

79%

21%

Financial services (n=2016)

81%

19%

Healthcare (n=139)

73%

27%

IT, technology and telecoms (n=73)

47%

53%

Local/state government (n=155)

76%

23%

Manufacturing & production (n=205)

68%

32%

Media, leisure, entertainment (n=96)

81%

18%

Retail (n=244)

71%

28%

Other (n=59)

75%

25%

Yes – Data was encrypted

No – Data was not encrypted

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Consolidation of answer options. Base numbers in chart

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Data Recovery by Country
Did your organization get any data back?

US(N=274)BRAZIL(N=98)GERMANY(N=122)

AUSTRIA(N=48)SWITZERLAND(N=68)

UK(N=66)

ITALY(N=82)

SPAIN(N=93)FRANCE(N=68)SOUTH
AFRICA(N=139)

INDIA(N=167)

AUSTRALIA(N=96)

JAPAN(N=125)SINGAPORE(N=51)

Yes, we paid the ransomand got data back

54%

55%

44%

42%

38%

44%

54%

29%

22%

45%

43%

53%

52%

53%

Yes, we used backups
to restore the data

66%

61%

78%

73%

84%

68%

55%

81%

87%

76%

73%

73%

60%

57%

Yes, we used other means
to get our data back

1%

4%

1%

0%

3%

0%

0%

0%

3%

3%

3%

3%

6%

0%

No, even though we
paid the ransom

1%

0%

0%

0%

0%

5%

2%

0%

3%

0%

1%

0%

0%

0%

No, we didn’t pay the ransom

0%

1%

2%

2%

1%

2%

5%

2%

0%

0%

1%

1%

5%

10%

Don’t know

0%

0%

2%

0%

0%

0%

0%

0%

0%

0%

0%

0%

0%

0%

Got data back via any method

99%

99%

95%

98%

99%

94%

93%

98%

97%

100%

98%

99%

95%

90%

Use more than one method
to recover data

22%

21%

27%

17%

26%

18%

16%

12%

12%

24%

20%

29%

22%

20%

Paid the ransom

55%

55%

44%

42%

38%

48%

56%

29%

25%

45%

44%

53%

52%

53%

Percentage of those that paid theransom that didn’t get data back

1%

0%

0%

0%

0%

9%

4%

0%

12%

0%

3%

0%

0%

0%

A Sophos Whitepaper. May 2023

The State of Ransomware 2023

Mean Recovery Cost by Revenue$5,000,000$4.496.086$4,500,000$4,000,000$3,500,000$3,000,000$2.390.607$2,500,000$2,000,000$1.450.824$1,500,000$1.104.811$1,000,000$500,000$0$885.018$704.284$165.520
Less than$10 million(n=62)$10 - $50
million(n=135)$50 - $250
million(n=426)

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack(considering downtime, people time, device cost, network cost, lost opportunity etc.)? Base numbers in chart.

A Sophos Whitepaper. May 2023

$250 - $500
million(n=286)$500 million
to $1 billion(n=422)$1 billion
to $5 billion(n=307)$5 billion
plus(n=336)

The State of Ransomware 2023

Research Methodology

Respondents by Organization Size (number of employees)

Sophos commissioned an independent, vendor-agnostic survey of 3,000
cybersecurity/IT leaders that was conducted between January and March 2023.
Respondents were based in 14 countries across the Americas, EMEA, and Asia
Pacific.
All respondents were from organizations with between 100 and 5,000 employees(50% 100-1,000 employees, 50% 1,001-5,000 employees). Within the researchcohort, annual revenue ranged from less than $10 million to more than $5 billion.

457

279

100-250451

501-1,000
1043

1,001-3,000

770

3,001-5,000

Respondents by Country
COUNTRYNUMBER OFRESPONDENTS

COUNTRYNUMBER OFRESPONDENTS

United States

500

United Kingdom

200

Germany

300

South Africa

200

India

300

France

150

Japan

300

Spain

150

Australia

200

Austria

100

Brazil200

Singapore100

Respondents by Organization Size (annual revenue)
106
469

Less than $10 million

241$10 - $50 million$50 - $250 million

447

674

200

Switzerland

100

Sophos delivers industry leading cybersecurity solutions to businesses of all sizes, protecting them in real time from advanced threatssuch as malware, ransomware, and phishing. With proven next-gen capabilities your business data is secured effectively by productsthat are powered by artificial intelligence and machine learning.
© Copyright 2023. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2023-05-05 (WP-DD)$250 - $500 million$500 million - $1 billion

633
430

Italy

251-500$1 - $5 billion$5 billion +