The State ofRansomware 2024
Findings from an independent, vendor-agnostic surveyof 5,000 leaders responsible for IT/cybersecurity across
14 countries, conducted in January-February 2024.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Introduction
The fifth Sophos annual study of the real-world ransomware experiences oforganizations around the globe explores the full victim journey, from root causethrough to severity of attack, financial impact, and recovery time. Fresh new insights
combined with learnings from our previous studies reveal the realities facing
businesses today as well as how the impact of ransomware has evolved over thelast five years.
This year’s report also incorporates brand new areas of study, including explorationof ransom demands vs. ransom payments, together with a heightened focus on
the impact an organization’s revenue has on their ransomware outcomes. Plus,for the first time, it shines a light on the role of law enforcement in ransomware
remediation.

A note on reporting dates
To enable easy comparison of data across our annual surveys, we name the reportfor the year in which the survey was conducted: in this case, 2024. We are mindfulthat respondents are sharing their experiences over the previous year, so many of
the attacks referenced occurred in 2023.

About the survey
The report is based on the findings of an independent, vendor-agnostic survey
commissioned by Sophos of 5,000 IT/cybersecurity leaders across 14 countries
in the Americas, EMEA, and Asia Pacific. All respondents represent organizations
with between 100 and 5,000 employees. The survey was conducted by research
specialist Vanson Bourne between January and February 2024, and participants
were asked to respond based on their experiences over the previous year. Within the
education sector, respondents were split into lower education (catering to students
up to 18 years) and higher education (for students over 18 years).

A Sophos Whitepaper. April 2024

	5,000

respondents

14countries

100-5,000

	employee organizations(50% 100-1,000, 50% 1,001-5,000)

15

industry segments

The State of Ransomware 2024

Rate of Ransomware Attacks

Attacks by Revenue

59% of organizations were hit by ransomware last year, a small but welcome
drop from the 66% reported in both the previous two years. While any reduction is
encouraging, with more than half of organizations experiencing an attack, this is notime to lower your guard.

Encouragingly, all revenue segments reported a reduction in ransomware attack ratein the last year (although for $500M - $1B it was less than one percentage point).

2020

2021

2022

2023

2024

51%

37%

66%

66%

59%

The propensity to be hit by ransomware generally increases with revenue, with $5B+
organizations reporting the joint highest rate of attack (67%). However, even thesmallest organizations (less than $10M revenue) are still regularly targeted, withjust under half (47%) hit by ransomware in the last year. While many ransomware
attacks are executed by sophisticated, well-funded gangs, the use of crude, cheap
ransomware by lower-skilled threat actors is on the rise.

In the last year, has your organization been hit by ransomware?
Yes. n=5,000 (2024), 3,000 (2023), 5,600 (2022), 5,400 (2021), 5,000 (2020).

Percentage of organizations hit by ransomware in the last year

67%

63%
58%

56%
47%

Less than $10M
(n=83)

56%

67%
59%

$10M - $50M
(n=581)$50M – $250M(n=988)$250M - $500M(n=581)

2024

In the last year, has your organization been hit by ransomware? Yes. n=5,000 (2024), 3,000 (2023). 2024 segment base numbers in chart.

A Sophos Whitepaper. April 2024

72%

69%

67%
57%

50%

Annual revenue
2023

67%

$500M - $1B(n=860)$1 billion to $5 billion(n=216)$5B +(n=804)

The State of Ransomware 2024

Attacks by Industry

Attacks by Country

With a few exceptions, ransomware attack rates were broadly consistent acrossthe different sectors, with between 60% and 68% of organizations hit in 11 of the
15 industries covered. The notable winners in this year’s study are state/local
government (34%) and retail (45%) where fewer than half of respondents reported
being hit in the last year.

France reported the highest rate of ransomware attacks in 2024 with 74% of
respondents saying they had been hit in the last year, followed by South Africa (69%)
and Italy (68%). Conversely, the lowest reported attack rates were by respondents in
Brazil (44%), Japan (51%), and Australia (54%).

Interestingly, the two government sectors occupy opposing positions, with central/federal government reporting the highest attack rate across all industries (68%),
double the rate reported by state/local government (34%). At the same time,reflecting the general downward trend in attacks, the central/federal government
rate is lower than the sector’s 2023 figure of 70%.
There are several possible reasons behind this government variance. In a yearof widespread unrest, it may be that central governments have experienced anincrease in politically motivated attacks. The results could also reflect efforts overthe last year by state/local government organizations to strengthen their resilience
to attack – or a shift in approach by adversaries in response to the state/local
government sector’s limited ability to pay ransoms.
Other notable industry changes over the last year include:Ì Reduction in the highest individual rate of attack reported, down from80% (lower education) to 69% (central/federal government)Ì The education sector no longer reports the two highest rates
of attack, coming in at 66% (higher education) and 63% (lower
education) this year vs. 79% and 80% respectively last yearÌ Healthcare was one of five sectors that reported an increase
in attack rate over the last year, up from 60% to 67%
Ì IT, telecoms, and technology no longer has the lowest attack rate with 55% oforganizations hit in the last year, an increase from the 50% reported in 2023
See the appendix for a detailed breakdown of rate of ransomware attacks byindustry.

A Sophos Whitepaper. April 2024

Overall, nine countries reported a lower attack rate than in 2023. The five countries
that reported a higher rate of attack than in 2023 are all in Europe: Austria, France,
Germany, Italy, and the UK (Germany’s increase was less than 1%). This may reflect
an increase in targeting of European organizations or that European defenses havebeen less able to keep pace with the evolving attacker behaviors than in othergeographies.
See the appendix for a detailed breakdown of rate of ransomware attacks by country.

The State of Ransomware 2024

Percentage of Computers Impacted
On average, just under half (49%) of an organization’s computers are impacted by aransomware attack. Having your full environment encrypted is extremely rare, with
only 4% of organizations reporting that 91% or more of their devices were impacted.
At the other end of the scale, while some attacks do impact only a handful ofdevices, this too is highly unusual, with only 2% of affected organizations saying thatfewer than 1% of their devices were affected.
Percentage of devices impacted in the victim organization
Proportion of
respondents
14%
13%
12%
11%

12%

12%

12%

10%
9%

8%
8%

6%

9%

8%

4%
4%
2%

0%

2%
Less than 1%

1-10%

11-20%

21-30%

31-40%

41-50%

51-60%

61-70%

Percentage of devices impacted in the victim organization
What percentage of your organization’s computers were impacted by ransomware in the last year? n=2,974 organizations hit by ransomware.

A Sophos Whitepaper. April 2024

71-80%

81-90%

91-100%

The State of Ransomware 2024

Percentage of Computers Impacted by Revenue

Percentage of Computers Impacted by Industry

While globally, across all respondents, the distribution was broad, we see
considerable variation in devices impacted both by organization size and industry.

IT, technology and telecoms reported the smallest percentage of devices impacted(33%), reflecting the strong cyber posture that is often seen in this sector.
Conversely, energy, oil/gas and utilities is the sector where the effects of an attack
are most broadly experienced, with 62% of devices impacted, on average, followed
by healthcare (58%). Both industries are challenged by higher levels of legacy
technology and infrastructure controls than most other sectors, which likely makes
it harder to secure devices, limit lateral movement, and prevent attacks fromspreading.

As revenue increases, so does the proportion of the computer estate that was
impacted in the ransomware attack, with the smallest organizations (less than
$10M) reporting half the percentage of devices impacted compared to those withrevenue of $1B or more (27% vs. 54%).
There are several factors that may contribute to this finding. Smaller organizations
are less likely to centrally manage all their devices, reducing the opportunity for
attacks to spread across the estate. Additionally, most small businesses andstartups are heavy users of SaaS platforms, reducing the risk of business outage
from threats like ransomware.

48%

47%

54%

54%

$1B - $5B
(n=632)$5B +(n=542)

48%

39%

27%

Less than$10M(n=39)$10M- $50M(n=291)$50M –$250M(n=557)$250M- $500M(n=341)

$500M
- $1B
(n=572)

Annual revenue
What percentage of your organization’s computers were impacted by ransomware in the last year? n=2,974 organizations hit
by ransomware.

A Sophos Whitepaper. April 2024

See the appendix for a detailed breakdown of percentage of computers impacted byindustry.

The State of Ransomware 2024

Root Causes of Ransomware Attacks
99% of organizations hit by ransomware were able to identify the root cause of theattack, with exploited vulnerabilities the most commonly identified starting point
for the second year running. Overall, the running order remained consistent with our2023 study.
Email-based approaches were identified as the root cause of attack by 34% of
respondents, with around twice as many starting with a malicious email (i.e., amessage with a malicious link or attachment that downloads malware) as phishing(i.e., a message designed to trick readers into revealing information). It’s worth
noting that phishing is typically used to steal log-in details and as such can beconsidered the first step in a compromised credentials attack.

32%

Exploited vulnerability

36%

29%
29%

Compromised credentials

23%

Malicious email

18%

11%

Phishing

13%

3%
3%

Brute force attack

1%

Download

1%

0%

5%

10%

15%

20%

Percentage of attacks
2024

2023

Do you know the root cause of the ransomware attack your organization experienced in the last year? Yes. n=2,974 organizations hit by ransomware.

A Sophos Whitepaper. April 2024

25%

30%

35%

40%

The State of Ransomware 2024

Exploited Vulnerability Attacks

Root Cause by Industry

While all ransomware attacks have negative outcomes, some are more devastating
than others. Organizations whose attacks began with exploitation of an unpatchedvulnerability report considerably more severe outcomes than those where the attack
started with compromised credentials, including a higher propensity to:

Certain weaknesses in cyber defenses are more prevalent in some sectors thanothers, and adversaries are quick to take advantage. As a result, the root cause ofransomware attacks varies considerably by industry:Ì Have backups compromised(75% success rate vs. 54% for compromised credentials)
Ì Have data encrypted(67% encryption rate vs. 43% for compromised credentials)
Ì Pay the ransom(71% payment rate vs. 45% for compromised credentials)
Ì Cover the full cost of the ransom in-house (31% funded the fullransom in-house vs. 2% for compromised credentials)
They also reported:Ì 4X higher overall attack recovery costs($3M vs. $750K for compromised credentials)
Ì Slower recovery time (45% took more than a monthvs. 37% for compromised credentials)
For a deeper dive, read Unpatched Vulnerabilities: The Most Brutal Ransomware
Attack Vector.

A Sophos Whitepaper. April 2024

Ì Energy, oil/gas and utilities is the sector most likely to fall victim to the
exploitation of unpatched vulnerabilities, with almost half (49%) of attacks
beginning in this way. This industry typically uses a higher proportion ofolder technologies more prone to security gaps than many other sectors,
and patches may not be available for legacy and end-of-life solutions
Ì Government organizations are particularly vulnerable to attacks thatstart with abuse of compromised credentials: 49% (state/local) and 47%(central/federal) of attacks began with the use of stolen login data
Ì IT, technology and telecoms and retail both reported that 7% of
ransomware incidents began with a brute force attack – it may be that
their reduced exposure to unpatched vulnerabilities and compromised
credentials forces adversaries to focus, in part, on other approaches
See the appendix for a detailed breakdown of rate of the root cause of attack byindustry.

The State of Ransomware 2024

Root Cause by Revenue

Compromised credentials as a ransomware attack vector peaks in the mid/highrevenue cohorts and is the top cause of attack in both the $250M-$500M and$500M-$1B segments. While vulnerabilities and compromised credentials rightly
get a lot of focus, malicious email is the top reported root cause in $10M-$50M
organizations. Overall, email-based threats account for just under half (49%) of
attacks in this space.

Generally speaking, larger organizations are more likely to experience an attack thatstarts with an unpatched vulnerability, with the $5B+ segment reporting the highest
percentage of attacks that started in this way (38%). It is likely that IT infrastructures
increase in both size and complexity as organizations grow, making it harder for IT
teams to see all their exposures and patch before they are exploited.

38%
35%

32%
29%

28%

32%

28%

27%
26%

34%
33%

32%

25%

25%
23%

23%

22%

22%

22%

20%

20%

18%

15%
23%
11%
9%

9%

8%
5% 5%

5%
4%
2% 2%

2%

2%

$10M - $50M
(n=291)

1%

1%

0%

0%

Less than $10M
(n=39)

4%$50M – $250M(n=557)0%$250M - $500M(n=341)2%
1%

0%$500M - $1B(n=572)

2%

1%

1%

$1B - $5B
(n=632)$5B +(n=542)

Annual revenue
Exploited vulnerability

Compromised credentials

Malicious email

Phishing

Do you know the root cause of the ransomware attack your organization experienced in the last year? n=2,974 organizations hit by ransomware.

A Sophos Whitepaper. April 2024

Brute force attack

DownloadUnknown0%The State of Ransomware 2024

Backup Compromise

Attempted Backup Compromise

There are two main ways to recover encrypted data in a ransomware attack:restoring from backups and paying the ransom. Compromising an organization’s
backups enables adversaries to restrict their victim’s ability to recover encrypted
data and dials up the pressure to pay the ransom.

94% of organizations hit by ransomware in the past year said that the cybercriminals
attempted to compromise their backups during the attack. This rose to 99% in bothstate/local government, and the media, leisure and entertainment sector. The lowest
rate of attempted compromise was reported by distribution and transport, howevereven here more than eight in ten (82%) organizations hit by ransomware said theattackers tried to access their backups.

Percentage of attacks where adversaries attempted to compromise backups

90%

90%

92%

93%

93%

95%

95%

95%

Retail(n=261)Other(n=108)Manufacturing
andproduction(n=378)

Healthcare(n=271)Highereducation(n=197)Lower
education(n=190)

96%

98%

98%

98%

99%

99%

Central/federalgovernment(n=175)Business andpro. Services(n=128)

State/ local
government(n=93)Media,
leisure andentertainment(n=157)82%

Distribution IT, technology
and transport and telecoms(n=149)(n=143)Financialservices(n=387)

Did the cybercriminals try to compromise your organization’s backups? Yes. Base number in chart.

A Sophos Whitepaper. April 2024

Construction Energy, oil/gas
and property
and utilities(n=154)(n=183)

The State of Ransomware 2024

Success Rate of Backup Compromise Attempts
Across all sectors, 57% of backup compromise attempts were successful, meaningthat adversaries were able to impact the ransomware recovery operations of overhalf of their victims. The analysis revealed considerable variation in adversary
success rate by sector:

Whatever the cause, organizations that had backups compromised reported
considerably worse outcomes than those whose backups were not breached:Ì Ransom demands were, on average, more than double that of those whose
backups weren’t impacted ($2.3M vs. $1M median initial ransom demand)Ì Organizations whose backups were compromised were almost twice
as likely to pay the ransom to recover encrypted data (67% vs. 36%)

Ì Attackers were most likely to successfully compromise their
victims’ backups in the energy, oil/gas and utilities (79%
success rate) and education (71% success rate) sectors

Ì Median overall recovery costs came in eight times higher ($3M
vs. $375K) for those that had backups compromisedÌ IT, technology and telecoms (30% success rate) and retail (47% successrate) reported the lowest rates of successful backup compromise

For a deeper dive, read The Impact of Compromised Backups on Ransomware
Outcomes.

There are several possible reasons behind the differing success rates. It may be that
IT, telecoms and technology had stronger backup protection in place to start with sowas more resilient to attack than other sectors. They may also be more effective at
detecting and stopping attempted compromise before the attackers could succeed.
Percentage of backup compromise attempts that succeeded

47%

48%

Retail(n=261)

Financialservices(n=387)51%

51%

State/ local
government(n=93)

Central/federalgovernment(n=175)

53%

79%

53%

56%

60%

61%

64%

71%

71%

Lower
education(n=190)Highereducation(n=197)66%

30%

IT, technology
and telecoms(n=143)Other(n=108)

Did the cybercriminals try to compromise your organization’s backups? Yes, Base number in chart.

A Sophos Whitepaper. April 2024

Manufacturing
Media,
Distribution
andleisure andand transport
production entertainment(n=149)(n=378)(n=157)

Construction
and property(n=154)

Business andprofessional
services

Healthcare(n=271)

Energy, oil/gas
and utilities(n=183)

The State of Ransomware 2024

Rate of Data Encryption

Data Encryption Rate by Industry

Seven in ten (70%) ransomware attacks in the last year resulted in data encryption.
While high, this rate represents a small drop from the 76% of attacks where
adversaries succeeded in encrypting data that was reported in 2023.

The 2024 survey reveals considerable variation in encryption rate across industries.
Ì While state/local government reported the lowest frequency of attack thisyear (34% hit by ransomware), it also reported the highest rate of dataencryption, with 98% of attacks resulting in data being encryptedÌ Financial services (49%) followed by retail (56%)
reported the lowest rates of data encryption
Ì Distribution and transport is the sector most likely to have experienced an
extortion-based attack with 17% saying that data was not encrypted but they
were held to ransom anyway – almost three times the rate of any other sector
See the appendix for a detailed breakdown of data encryption rates by industry.

76%

73%

70%
65%
54%

39%
31%
27%

24%

3%
2020 (n=2,538)

21%

7%

2021 (n=2,006)

Data was not encrypted but we were still held to ransom (extortion)

4%

3%

3%

2022 (n=3,702)

2023 (n=1,974)

2024 (n=2,974)

The attack was stopped before data was encrypted

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Base number in chart.

A Sophos Whitepaper. April 2024

Data was encrypted

The State of Ransomware 2024

Data TheftAdversaries don’t just encrypt data; they also steal it. In 32% of incidents where data
was encrypted, data was also stolen – slightly above last year's rate of 30%. Data theft
increases attackers’ ability to extort money from their victims, while also enablingthem to further monetize the attack by selling the stolen data on the dark web.
Again, there is considerable variation by industry. On the surface IT, technology andtelecoms fares worst, with 53% of attacks where data was encrypted reporting that
it was also stolen. Energy, oil/gas and utilities is in second position, with data stolenin 50% of encryption events. Conversely, the education sector is least likely to report
data theft in an attack, with higher education reporting the lowest overall propensity
to have data encrypted and stolen (18%), followed by lower education, which sharessecond spot with healthcare (both 22%).

The findings may reflect differing levels of investigation capabilities across thesectors, and differing priorities. Determining whether data has been exfiltrated
requires higher levels of forensic capabilities and often relies on logs from EDR/XDR
tools. It may be that the IT, technology and telecoms sector is simply better able toidentify data theft than other industries. The simplicity of many energy, oil/gas andutilities environments may also make theft easier to detect in this sector. Conversely,
schools often lack the skills and tools to determine whether data has been stolen.
At the same time, some organizations may prefer not to know if data has been
exfiltrated as a data breach would require them to undertake expensive disclosures.

Percentage of encryption events where data was also stolen

53%
50%
45%
40%

25%
22%

28%

32%

33%

33%

Retail(n=261)

Financialservices(n=387)

Business andpro. Services(n=128)

42%

35%

28%

22%

18%

Highereducation(n=197)Lower
education(n=190)

Healthcare(n=271)Other(n=108)Media,
Manufacturing
leisure andandentertainment production(n=157)(n=378)Distribution
and transport(n=149)Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Yes. Yes, and the data was also stolen. Base number in chart.

A Sophos Whitepaper. April 2024

Central/federalgovernment(n=175)

State/ local
government(n=93)

Construction Energy, oil/gas IT, technology
and property
and utilities and telecoms(n=154)(n=183)(n=143)

The State of Ransomware 2024

Data Recovery
98% of organizations that had data encrypted got data back. The two primary waysof recovering data were restoring from backups (68%) and paying the ransom to
get the decryption key (56%). 26% of those that had data encrypted indicated thatthey used "other means" to get data back – while the survey did not explore this area
further, this could include working with law enforcement or using decryption keys
that had already been made public.

Use backups torestore data

Paid the ransomand got data backUse other means
to get data backThe five-year view reveals that the gap between use of backups and payment of theransom continues to shrink. Backup use has fallen, albeit slightly, for the second
consecutive year. At the same time, there has been a 10-percentage point increasein ransom payments since the 2023 study. Propensity to pay the ransom depends
on many factors, including availability of backups. However, this is a worrying
trend and it is concerning that over half of victims are resorting to paying for thedecryption key.
73%
Used backups
56%

68%

56%

70%

57%

26%

68%
56%

46%

46%

2022
(n=2,398)2023(n=1,497)

32%
A notable change over the last year is the increase in propensity for victims to use
multiple approaches to recover encrypted data (e.g., paying the ransom and using
backups). Almost half of organizations that had data encrypted reported using morethan one method (47%) this time around, more than double the rate reported in
2023 (21%).

26%
Paid the ransom

2020(n=1,849)

2021(n=1,086)

Used backups to restore the data2024
(n=2,072)

Paid the ransom and got data backDid your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore thedata. Base numbers in chart.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Data Recovery by Revenue

Data Recovery by Industry

Propensity to pay the ransom to recover data generally increases with revenue. The
smallest revenue organizations (less than $10M) report by far the lowest ransom
payment rate (25%) while the largest revenue organizations ($5B+) have the highest
payment rate (61%). The fundamental availability of funds to cover the ransom islikely a major factor at play here – many very small businesses are simply unable tofind the money to pay a ransom.

Perhaps unsurprisingly, central/federal government is the sector least likely to pay
the ransom to get data back – no doubt it is highly limited in the ability to pay by
regulations – and also reported the highest use of backups to restore data (39% and
81% respectively).

However, as we’ve seen, data recovery is not a case of either backups or ransom. The
nuances behind data recovery methods become apparent when we dive deeper into
the data and compare the 2024 figures with last year’s results.
Outside the sub $10M group, all revenue segments reported an increased ransom
payment rate compared to last year, and three of them also reported an increase in
the use of backups to restore the data. While the lowest revenue group reported thehighest rate of backup use (88%), the $250M-$500M was close behind (85%).

Overall, there is no smooth correlation between backup use and ransom payments:
Ì Media, leisure and entertainment reported the highest rate of ransom payment
to recover data (69%) and also one of the higher rates of backup use (74%)Ì Energy, oil/gas and utilities has the lowest level of backup use (51%) andhas a ransom payment rate of 61%, lower than four other sectors
See the appendix for a detailed breakdown of data recovery method by industry.

ANNUAL REVENUE
Less than $10M
(n=39)
Data recovery
method used

$10M - $50M
(n=291)$50M – $250M(n=557)$250M - $500M(n=341)$500M - $1B(n=572)$1B - $5B
(n=632)$5B +(n=542)

2023

2024

2023

2024

2023

2024

2023

2024

2023

2024

2023

2024

2023

2024

Used backups torestore the data

80%

88%

72%

68%

77%

60%

75%

85%

68%

70%

66%

65%

63%

66%

Paid the ransomand got data back

36%

▲
25%

▼

▼
41%

49%

▲

▼
42%

57%

▲

▲
33%

50%

▲

▲
51%

59%

▼
52%

▲

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore the data. 2024 base numbers in chart. Arrow indicates increase/decrease vs. 2023.

A Sophos Whitepaper. April 2024

56%

▲

▲
55%

61%

▲

The State of Ransomware 2024

Ransom Demands
This year, for the first time, we included both ransom demands and payments inthis report. Across the 1,701 organizations that had their data encrypted and wereable to share the initial ransom demand from the attackers, the average ask was$4,321,880 (mean) and $2M (median).
One of the most notable findings in this year’s study is that 63% of ransom demands
are for $1M or more, with 30% of demands for $5M or more. While a small numberof respondents reported four-figure ransom demands, these are very much in theminority.

Percentage of demands forthe ransom amount
35%

33%
30%

30%
25%
20%
15%
10%

8%
7%

5%
1%

1%

Less than$1,000Between$1,000 and$4,999

2%

3%

7%

4%

4%

0%
Between$5,000 and$9,999Between$10,000 and$19,999

Between$20,000 and$49,999

Between$50,000 and$99,999

Between$100,000 and$249,999

Ransom demand amountHow much was the ransom demand from the attacker(s)? n=1,701

A Sophos Whitepaper. April 2024

Between$250,000 and$499,999

Between$500,000 and$999,999

Between$1,000,000 and$4,999,999$5 million or
moreThe State of Ransomware 2024

Ransom Demand by Revenue

Ransom Demand by Industry

Looking at both mean and median data, the ransom demand trends upward withrevenue, indicating that adversaries adjust their ransom demand based – in part, atleast – on likely ability to pay.

There are no winners here, with all named sectors (excluding "other") reporting
median ransom demands of $1M or higher.

Huge ransom demands are no longer the preserve of the highest-revenue
organizations, and $1M or more asks are now commonplace across the board:
47% of organizations with revenue of $10M-$50M received a seven-figure ransom
demand in the last year.

Ì Retail and IT, technology and telecoms received the lowest
median demands ($1M), followed by construction ($1.1M)
Ì Central/federal government is the sector with the biggest target on its
head, reporting the highest median ($7.7M) and mean (9.9M) demands
See the appendix for a detailed breakdown of ransom demand by industry.

ANNUAL REVENUE
Ransom Demand$10M - $50M
(n=207)$50M – $250M(n=288)$250M - $500M(n=158)$500M - $1B(n=268)$1B - $5B
(n=366)$5B +(n=398)Mean average$1,774,941$1,704,853$3,407,796$5,184,024$4,281,258$7,467,294

Median average$330,000$220,000$840,000$2,000,000$3,000,000$6,600,000

How much was the ransom demand from the attacker(s)? Base numbers in chart. N.B. "Less than $10M" has been excluded from this table due to the low number of respondents in this revenue segment.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Ransom Payments

Ransom Payments by Industry

1,097 respondents whose organization paid the ransom shared the actual sum paid.
Looking at both median and mean averages, we see that ransom payments haveincreased considerably in the last year:

Just as average ransom demands vary considerably by industry, so too do theransom payments. IT, technology and telecoms reported the lowest median ransom
payment ($300,000), followed by distribution and transport ($440,000). At the otherend of the scale, both lower education and central/federal government paid medianransoms of $6.6M.

Ì Median payment: $2,000,000 (a 5X increase on the $400,000 reported in 2023)
Ì Mean payment: $3,960,917 (a 2.6X increase on the $1,542,330 reported in 2023)

While there is a broad correlation between lower demands and lower payments (andvice versa), there are exceptions – notably distribution and transport, whose medianransom demand was north of $2.8M but paid, on average, $440,000.

The chart below makes clear how the proportion of lower ransom payments has
steadily decreased over the last three years, while the proportion of very highpayments has soared. Paying a seven-figure or more ransom sum is now the norm.

See the appendix for a detailed breakdown of average ransom payment by industry.

Distribution of ransom payments 2022-24
31%

31%

27%

17%
14%
11%
8%
5%

4%
2%

Less than $1,000

2%

6%

8%

7%
6%

6%
3%

6%

Between $5,000
and $9,999

2023 (n=216)

Between $10,000
and $19,999

2024 (n=1,097)

How much was the ransom payment that was paid to the attackers? Base numbers in chart.

A Sophos Whitepaper. April 2024

8%

7%

4%

4%

Between $20,000
and $49,999

Between $50,000
and $99,999

Between $100,000
and $249,999

Ransom payment
2022 (n=965)

6%

4%

2%

2%

Between $1,000
and $4,999

10%

10%

9%

5%

13%

13%

12%

Between $250,000
and $499,999

Between $500,000
and $999,999

Between$1,000,000 and$4,999,999$5 million or more

The State of Ransomware 2024

Ransom Demand vs. Ransom Payment
When data has been encrypted, it is an incredibly high-pressure time for everyone
involved, with both sides trying to optimize their outcomes. Organizations whose
data has been encrypted look to minimize the financial impact, while adversaries
attempt to secure as much money as possible in the shortest possible timeframe,
often using the threat that the ransom will increase if payment is not made by acertain time to pile on further pressure.

Looking at the data by industry, we see that the two services sectors – businessand professional services and financial services – are most likely to negotiate down
the ransom payment, with 67% saying that they paid less than the original demand.
Manufacturing and production is close behind with 65% of organizations paying lessthan the initial ask.
Conversely, the sectors most likely to pay more than the original demand are thosewith a high proportion of public sector organizations:

Propensity to Negotiate Ransom Amounts

Ì Higher education is most likely to pay more than the original demand (67% paidmore), and least likely to pay less than the original demand (20% paid less)

The study has revealed that victims rarely pay the initial sum demanded by theattackers, with only 24% of respondents saying that their payment matched theoriginal request. 44% paid less than the original demand, while 31% paid more.

Ì Healthcare was second most likely to pay more than the original demand(57% paid more), followed by lower education (55% paid more)
It may be that these industries are less able to access professional ransom
negotiators to help reduce their costs. They may also have a greater need to recover
the data "at any cost" due to their public remit. Either way, it’s clear that there is room
for movement between the original demand and the eventual payment.

24%
Paid LESS than the original demand
44%
31%

Paid MORE than the original demand
Paid the ORIGINAL demand

How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to theattackers? n=1,097.

A Sophos Whitepaper. April 2024

See the appendix for a detailed breakdown of ransom demand vs. ransom payment
by industry.

The State of Ransomware 2024

Proportion of Ransom Demand Paid

Proportion of Ransom Demand Paid by Industry

While negotiation on the ransom amount occurs in the majority of cases, theeventual movement is relatively small with respondents reporting that 94% of theoriginal demand was paid, on average, across the full cohort.

At an industry level, we see that the sectors most likely to negotiate down theransom amount also pay the lowest percentage of the initial ask – and vice versa.

Diving deeper, we see that all revenue groups except the very largest were able toreduce the size of the ransom payment. The $50M-$250M segment paid the lowest
proportion of the initial demand (84%). The only group to pay more than the initial
ask is the $5B+ segment which covered, on average, 115% of the ransom demand.
ANNUAL REVENUE
CohortProportionof ransom
demand paid

$10M - $50M
(n=100)$50M –$250M(n=206)$250M $500M(n=104)$500M - $1B(n=175)$1B - $5B
(n=233)$5B +(n=275)

93%

84%

90%

88%

85%

115%

How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to theattackers? n=1,097. Note: the ‘less than $10M’ cohort is excluded from the annual revenue breakdown due to very low
response base.

LESS THAN 100%

MORE THAN 100%

Manufacturing and production (70%)

Higher education (122%)

Business and professional
services (74%)

Lower education (115%)

Financial services (75%)

Healthcare (111%)

Other (79%)

State/local government (104%)

IT, telecoms and technology (82%)

Central/federal government (103%)

Retail (84%)

Energy, oil/gas and utilities (101%)

Construction and property (95%)
Distribution and transport (95%)
Media, leisure and entertainment (95%)
How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to theattackers? n=1,097.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Source of Ransom Funding

Ransom Transaction Execution

Who provides the money for the ransom is an area of considerable interest, and thestudy has revealed a number of insights in this area:

While multiple bodies can contribute to the ransom, funds are typically transferred ina single payment by one party.

Ì Funding the ransom is a collaborative effort, with respondents reporting
multiple sources of monies in more than four-fifths (82%) of casesÌ The primary source of ransom funding is the organization itself,
covering 40% of the payment on average; the organization’s parent
company and/or governing body typically provides 19%
Ì Insurance providers are heavily involved in ransom payments

Globally, insurance providers transferred the funds for almost half of ransom
payments, either directly (26%) or through their appointed incident response
specialist (21%). The victim organization made 37% of payments, while 8% were
executed by the victim’s legal firm.
Overall, 28% (with rounding) of transfers were made by incident response specialists,
whether appointed by the insurance provider (21%) or another party, typically thevictim (6%).

 23% of all ransom payment funding comes from insurance providers
 Insurance providers contribute toward the ransom in 83% of attacks
 However, providers very rarely (1%) cover the full amount and in 79%
of cases, the insurer funded less than half of the total payment

Executor of ransom payment transfer
6%

Organization

2%

Organization’s cyber insurance provider

8%

Source of ransom payment funding
37%
18%

Organization
40%

Organization’s legal firm

21%

Cyber insurance provider
Parent company/governing body

19%

Personal finances of an individual
23%

Incident response specialist provided
by the organization’s cyber insurance
provider26%

Incident response specialist notprovided by my organization’s cyber
insurance provider
Individual who used their personal
finances to help fund the ransom
payment

Who made the ransom payment transaction i.e., who transferred the money to the attacker’s account? n=1,168.
From which of the following source(s) was the money to fund the ransom payment obtained? n=1,168.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Recovery Costs

The greatest increase in overall recovery costs was experienced by the lower andmid-revenue segments, with the $250M-$500M cohort reporting the biggest
individual increase of $2M (from $885,018 to $2,885,296).

Ransom payments are just one element of recovery costs when dealing withransomware events. Excluding any ransoms paid, in 2024, organizations reported
a mean cost to recover from a ransomware attack of $2.73M, an increase of almost$1M from the $1.82M reported in 2023.

2021

2022

2023

2024

$1.85M$1.4M$1.82M$2.73M

Organizations with $1B-$5B revenue reported a (relatively) small increase of justover $400,000, while the largest organizations with $5B+ annual revenue were theonly cohort to experience a reduction in recovery cost, down from $4,496,096 to$3,767,731.
Looking at the median recovery cost data confirms the trends. Globally, medianrecovery costs doubled from $375,000 to $750,000 over the last year. Increases
were mostly concentrated in the five lower revenue cohorts who all reported aconsiderable increase in costs, while remaining relatively flat for the two larger.

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack(considering downtime, people time, device cost, network cost, lost opportunity etc.)? n=2,974 (2024)/ 1,974 (2023)/ 3,702(2022)/ 2,006 (2021). N.B. 2022 and 2021 question wording also included “ransom payment”.

$4,496,086$3,767,731$2,844,296$2,581,460$2,435,089$1,530,886$1,222,487$2,815,793$2,390,607$1,450,824$1,104,811$704,284$885,018$165,520
Less than $10 million(n=39/62)
2023

2024

$10-$50 million(n=291/135)$50-$250 million(n=557/426)$250-$500 million(n=341/286)$500 million to $1 billion(n=572/422)$1 billion - $5 billion(n=632/307)

Annual revenue

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack (considering downtime, people time, device cost, network cost, lost opportunity etc.)?
n=2,974 (2024), 1,974 (2023). 2024/2023 base numbers by revenue in chart

A Sophos Whitepaper. April 2024

$5 billion plus
(n=542/336)

The State of Ransomware 2024

Recovery TimeThe time taken to recover from a ransomware attack is getting steadily longer. Our
2024 research revealed:Ì 35% of ransomware victims are fully recovered in a weekor less, down from 47% in 2023 and 52% in 2022
Ì One third (34%) now take more than a month to recover,up from 24% in 2023 and 20% in 2022
This slowdown may reflect the increased complexity and severity of attacks,
necessitating greater recovery work. It may also indicate a growing lack of recovery
preparation.

39%

39%

29%

28%

30%

27%

27%

16%

18%

14%
8%

7%

6%
4%

Less than a day

Up to a week

Up to 1 monthTime to recover from the attack

2022 (n=3,702)

2023 (n=1,974)

2024 (2,974)

How long did it take your organization to fully recover from the ransomware attack? Base number in chart.

A Sophos Whitepaper. April 2024

1-3 months

3-6 months

8%

The State of Ransomware 2024

Recovery Time: Impact of Backup Compromise

Recovery Time: Impact of Data Encryption

Having your backups compromised has a major impact on overall recovery time.
Almost half of organizations whose backups are not compromised recover in a weekor less (46%), compared to a quarter (25%) of those whose backups are affected.
Having your backups compromised both increases the complexity of recovering
encrypted data while adding the overhead of creating and securing new, untainted
backups.

It is likely no surprise that having data encrypted in an attack significantly increases
recovery time. 57% of those who didn’t have data encrypted were fully recovered
within a week, compared to 25% of those whose data was encrypted.

42%

36%
34%

33%

33%
31%

27%
24%
22%

21%
18%

16%

15%
10%

10%

9%
7%
4%

4%
2%

Less than a day Up to a week

Up to 1 month

1-3 months

3-6 months

Time to recover from the attack
Backups not compromised (n=1,379)

Backups compromised (n=1,595)

How long did it take your organization to fully recover from the ransomware attack? Base numbers in chart.

A Sophos Whitepaper. April 2024

Less than a day Up to a week

Up to 1 month

1-3 months

3-6 months

Time to recover from the attack
Data not encrypted (n=902)

Data encrypted (n=2,072)

How long did it take your organization to fully recover from the ransomware attack? Base numbers in chart.

The State of Ransomware 2024

Involvement of Law and OrderThe nature and availability of official support when dealing with a ransomware
attack vary on a country-by-country basis, as do the tools to report a cyberattack. US
victims can leverage the Cybersecurity and Infrastructure Security Agency (CISA);
those in the UK can get advice from the National Cyber Security Centre (NCSC); andAustralian organizations can call on the Australian Cyber Security Center (ACSC), toname but a few.

61%

Reflecting the normalization of ransomware, 97% of organizations globally thatwere hit by ransomware engaged with law enforcement and/or official government
bodies due to the attack. 61% reported that they received advice on dealing withthe attack, 60% got help investigating the attack, and 40% said they received help
recovering from the attack.

60%

40%

3%
They gave us advice on
dealing withthe attack

They helped us toinvestigate theattackThey helped us torecover data encryptedin the attack

They were not involved
because we did notreport the attack

1%0%

They were not involved
although we did report
the attack

They were involved inother ways

How law enforcement and/or government bodies were involved
If your organization reported the attack to law enforcement and/or an official government body, how did they get involved? n=2,974.

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Ease of Engagement

Non-involvement of Official Bodies

Encouragingly, more than half (59%) of those that engaged with law enforcement
and/or official bodies in relation to the attack said the process was easy (23% very
easy, 36% somewhat easy). Only 10% said the process was very difficult, while 31%
described it as somewhat difficult.

There were a range of reasons why 3% (86 respondents) did not report the attack,with the two most common being concern that it would have a negative impact on
their organization, such as fines, charges, or extra work (27%), and because they
did not think there would be any benefit to them (also 27%). Several respondents
provided verbatim feedback that they did not engage official bodies as they wereable to resolve the issue in-house.

10%
23%

Very easy
Somewhat easy

31%

Somewhat difficult
36%

Very difficult

How easy or difficult was it for your organization to engage with law enforcement and/or official bodies in relation to theattack? n=2,874 (excluding ‘don’t know’ responses).

We were concerned that it would have a negative impact on
our organization e.g., fines, charges, extra work

27%

We did not think there would be any benefit to our organization
to report the attack

27%

We did not think they would be interested in the attack

22%

We were too busy dealing with the attack to think about
involving them

21%

The attackers warned us not to engage them19%

We did not know which law enforcement or official bodies toinvolve10%

We were not legally required to report the attack

9%

Other (please specify)

3%

Don’t know

1%

Why didn’t you report the attack to law enforcement and/or official bodies? (n=86).

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Conclusion

About Vanson Bourne

Ransomware remains a major threat to organizations of all sizes around the globe.
While the overall attack rate has dropped over the last two years, the impact of an
attack on those that fall victim has increased. As adversaries continue to iterate andevolve their attacks, it’s essential that defenders and their cyber defenses keep pace.

Vanson Bourne is an independent specialist in market research for the technology
sector. Their reputation for robust and credible research-based analysis is founded
upon rigorous research principles and their ability to seek the opinions of seniordecision makers across technical and business functions, in all business sectors
and all major markets. For more information, visit www.vansonbourne.com

Prevention. The best ransomware attack is the one that didn’t happen because theadversaries couldn’t get into your organization. With a third of attacks starting with
exploitation of unpatched vulnerabilities, it’s important to take control of your attack
surface and deploy risk-based prioritization of patching. The use of MFA to limit
credential abuse should also be a priority for every single organization. Ongoing user
training on how to detect phishing and malicious emails remains essential.
Protection. Strong foundational security is a must, including endpoint, email, andfirewall technologies. Endpoints (including servers) are the primary destination for
ransomware actors, so ensure that they are well defended, including dedicatedanti-ransomware protection to stop and rollback malicious encryption. Security
tools need to be correctly configured and deployed to provide optimal protection, so
look for solutions that deploy out-of-the-box with straightforward posture controls.
Protection that is complicated and hard to deploy can easily increase risk rather than
reduce it.
Detection and response. The sooner you stop an attack, the better. Detecting andneutralizing an adversary inside your environment before they can compromise yourbackups or encrypt your data will considerably improve your outcomes.
Planning and preparation. Having an incident response plan that you are wellversed in deploying will greatly improve your outcomes if the worst happens and you
experience a major attack. Regularly practice restoring data from backups to ensure
speed and fluency should you need to execute in the aftermath of an attack.
To explore how Sophos can help you optimize your ransomware defenses, speak to
an adviser or visit www.sophos.com

A Sophos Whitepaper. April 2024

The State of Ransomware 2024

Appendix
Percentage of Computers Impacted by Industry
Percentage of devices impacted

62%

50%
43%

44%

45%

Financialservices(n=387)

Manufacturing
andproduction(n=378)Other(n=108)

52%

52%

52%

53%

Business andpro. Services(n=128)Lower
education(n=190)Distribution
and transport(n=149)Construction
and property(n=154)

54%

55%

56%

58%

40%
33%

IT, technology
and telecoms(n=143)Retail(n=261)Highereducation(n=197)

Central/federalgovernment(n=175)What percentage of your organization’s computers were impacted by ransomware in the last year? n=2,974 organizations hit by ransomware. Industry base numbers in chart.

A Sophos Whitepaper. April 2024

Media,
leisure andentertainment(n=157)

State/ local
government(n=93)

Healthcare(n=271)

Energy, oil/gas
and utilities(n=183)

The State of Ransomware 2024

Rate of Ransomware Attacks by Industry
Percentage of organizations hit by ransomware in the last year

80%

69%

69%

67%
60%

60%

71%
62%

79%

70%
62%

63%

64%
58%

55%
50%

65%

64%

65%

66%

67% 67%

67%

70% 68%

60%
56%

50%

45%

34%

State/local
government(n=270)2023

Retail(n=577)

Business andpro. Services(n=257)IT, technology
and telecoms(n=262)Distribution
and transport(n=250)Construction
and property(n=250)Media,
leisure andentertainment(n=253)Lower
education(n=300)Other(n=170)2024

In the last year, has your organization been hit by ransomware? Yes. n=5,000 (2004) n=3,000 (2023), 5,600 (2022). 2024 industry base numbers in chart.

A Sophos Whitepaper. April 2024

Manufacturing
andproduction(n=585)

Financialservices(n=592)Highereducation(n=300)

Energy, oil/gas
and utilities(n=275)

Healthcare(n=402)Central/federalgovernment(n=257)

The State of Ransomware 2024

Rate of Ransomwares Attack by Country
Percentage of organizations hit by ransomware in the last year

84%
75%
70%

68%

78%

77%

68%
64%
58%

58%

58% 58%

68%
65%

69%
64%

59%
50%

44%

2023

59%

64%

66%

54%

51%

Brazil(n=330)

58%

74%

73%

44%

Japan
(n=500)Australia(n=330)US(n=855)Germany(n=500)UK(n=330)

Switzerland(n=165)Spain(n=250)2024

In the last year, has your organization been hit by ransomware? Yes. n=5,000 (2004) n=3,000 (2023). 2024 country base numbers in chart.

A Sophos Whitepaper. April 2024

Singapore(n=165)India(n=500)Austria(n=165)Italy(n=330)South Africa(n=330)France(n=250)

The State of Ransomware 2024

Root Cause of Attack by Industry
Business and pro. services (n=128)

34%

Central/federal government (n=175)

23%

Construction and property (n=154)

21%

35%
47%

Healthcare (n=271)

34%

State/local government (n=93)

Compromised credentials

30%

Phishing

8%

25%

15%
16%

36%
Malicious email

8%
10%

49%

Do you know the root cause of the ransomware attack your organization experienced in the last year? n=2,974 organizations hit by ransomware.

A Sophos Whitepaper. April 2024

15%

29%

20%

30%

11%

26%

22%

24%

Other (n=108)
Exploited vulnerability

25%

32%

21%

20%

38%

9%

22%

44%

Media, leisure and entertainment (n=157)

19%

23%
25%

27%

7%
12%

34%

28%

Retail (n=261)

14%
27%

42%

Lower education (n=190)

23%

27%
30%

Higher education (n=197)

Manufacturing and production (n=378)

16%

49%
27%

7%

18%

23%

Energy, oil/gas and utilities (n=183)

IT, technology and telecoms (n=143)

23%

36%

8%

18%

27%

Distribution and transport (n=149)

Financial services (n=387)

22%

15%
Brute force attack

Download

4%
15%
Unknown

The State of Ransomware 2024

Data Encryption Rate by Industry
Propensity to have data encrypted in an attack

5%
17%

19%
27%

2%

6%

14%

19%

21%

25%

31%

24%

22%

41%

15%

31%

39%

46%

98%
80%
73%

85%

80%
69%

77%

74%

68%

74%

76%

57%

62%

56%

49%

Business andpro. Services(n=128)Central/federalgovernment(n=175)Construction
and property(n=154)

Data was encrypted

Distribution Energy, oil/gas
and transport and utilities(n=149)(n=183)Financialservices(n=387)

Healthcare(n=271)

The attack was stopped before data was encrypted

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Base number in chart.

A Sophos Whitepaper. April 2024

Highereducation(n=197)IT, technology
and telecoms(n=143)Lower
education(n=190)

Manufacturing
Media,
andleisure andproduction entertainment(n=378)(n=157)Retail(n=261)

State/ local
government(n=93)

Data was not encrypted but we were still held to ransom (extortion)

Other(n=108)

The State of Ransomware 2024

Data Recovery Method by Industry
How often data is recovered by using backups and paying the ransom

81%
78%
74%

73%

62%

61%
58%

58%
51%

53%

74%

73%
67%

66%
59%

78%

75%

60%

60%

62%

61%

69%

62%
58%

54%
51%

48%
43%

43%

39%

Central/federalgovernment(n=140)Distribution
and transport(n=101)

Construction
and property(n=106)IT, technology
and telecoms(n=81)

Paid the ransom and got data backFinancialservices(n=189)Healthcare(n=201)

State/ local
government(n=91)

Other(n=67)

Retail(n=146)

Business and Energy, oil/gas Manufacturing
professional
and utilities
andservices(n=146)
production(n=93)(n=278)Used backups to restore the data

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore the data. Base numbers in chart. Ordered by propensity to pay the ransom.

A Sophos Whitepaper. April 2024

Lower
education(n=162)Highereducation(n=152)

Media,
leisure andentertainment(n=119)

The State of Ransomware 2024

Ransom Demand by Industry
Ransom demand$9,874,553$7,700,000$5,862,053$5,087,940$4,520,009$4,141,911$4,065,732$4,641,273$4,905,159$4,795,235$3,909,637$3,850,000$4,000,000$3,550,000$3,300,000$3,246,937$2,984,908$2,882,370$2,837,175$2,609,224$2,532,583$2,540,000$2,000,000$2,200,000$1,500,000$1,000,000$1,000,000$1,100,000$1,155,000$680,000

Other(n=55)MedianIT, technology
and telecoms(n=70)

Retail(n=131)

Construction
Media,
Manufacturing
and property
leisure andand(n=89)
entertainment production(n=106)(n=227)

Financialservices(n=165)Mean

How much was the ransom demand from the attacker(s)? Base numbers in chart. Ordered by median demand.

A Sophos Whitepaper. April 2024

Business and Energy, oil/gas Distribution
pro. Services
and utilities and transport(n=66)(n=132)(n=86)

State/local
government(n=30)

Highereducation(n=130)Lower
education(n=154)

Healthcare(n=155)Central/federal
government(n=75)

The State of Ransomware 2024

Ransom Payment by Industry
Ransom payment$7,408,688$6,600,000$7,460,007$6,600,000$5,852,461$5,261,248$4,410,000$4,402,330$4,173,184$3,312,416$3,225,093$3,040,958$2,992,594$2,743,732$2,496,301$2,229,621$2,540,000$2,367,061$2,229,116$2,000,000$2,000,000$2,200,000$1,470,000$946,000$300,000$440,000$1,050,000$465,000

IT, technology Distribution
and telecoms and transport(n=35)(n=43)Median$950,000$1,200,000

Other(n=32)Media,
leisure andentertainment(n=81)

Retail(n=78)

Construction Manufacturing
and property
and(n=46)
production(n=157)

Healthcare(n=99)

Mean

How much was the ransom payment that was paid to the attackers? Base numbers in chart. Data ordered by median payment.

A Sophos Whitepaper. April 2024

Business andpro. Services(n=55)

Financialservices(n=90)

State/local
government(n=49)

Energy, oil/gas
and utilities(n=86)

Highereducation(n=92)

Central/federal
government(n=55)

Lower
education(n=99)

The State of Ransomware 2024

Ransom Demand vs. Ransom Payment by Industry

Proportionof ransom
demand paid

Business and pro. Services (n=55)

67%

Central/federal government (n=55)

50%

Construction and property (n=46)

Healthcare (n=99)

50%
32%

111%

13%

122%

37%

82%

55%

13%

65%

Manufacturing and production (n=157)
47%

Media, leisure and entertainment (n=81)

8%
23%

53%

Retail (n=78)

Percentage that paid LESS than the original demand

13%

35%

Percentage that paid MORE than the original demand

How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to the attackers? Base numbers in chart.

70%

84%
20%

19%

115%

95%

34%

45%
56%

27%
30%

14%

75%

15%

67%

IT, technology and telecoms (n=35)

Other (n=32)

18%

57%

20%

State/local government (n=49)

101%

15%

28%

Lower education (n=99)

95%

48%

67%

103%
95%

28%

27%

Financial services (n=90)

A Sophos Whitepaper. April 2024

36%

36%

26%

74%
8%

22%

36%

Energy, oil/gas and utilities (n=86)

18%

42%

42%

Distribution and transport (n=43)

Higher education (n=92)

16%

26%

104%
79%

Percentage that paid the ORIGINAL demand

The State of Ransomware 2024

Sophos delivers industry leading cybersecurity solutions to businesses of all sizes, protecting them in real time from advanced threatssuch as malware, ransomware, and phishing. With proven next-gen capabilities your business data is secured effectively by productsthat are powered by artificial intelligence and machine learning.
© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-04-22 WP-EN (PC)