What Is Ransomware, and How Do You Prevent It?

Published 8 August 2026. Figures are drawn from the 2026 editions of the Verizon Data Breach Investigations Report, the Sophos State of Ransomware survey, the IBM Cost of a Data Breach Report and the Chainalysis Crypto Crime Report.

Ransomware is no longer a niche category of malware. It is the single most common ingredient in a serious security incident. Verizon’s 2026 Data Breach Investigations Report, built on more than 31,000 incidents across 145 countries, found ransomware present in 48% of all breaches, up from 44% a year earlier. In the EU, the European Union Agency for Cybersecurity (ENISA) records ransomware in 81.1% of cybercriminal incidents against European organisations and names it the most damaging threat on the continent.

What has changed is the economics. Attack volumes keep climbing while the money keeps falling. That gap is the whole story of ransomware in 2026, and it is the reason prevention now pays back faster than it used to.

Short answer: ransomware is malicious software that makes your data unusable, usually by encrypting it, and then demands payment to make it usable again. Modern attacks also steal the data first and threaten to publish it. You prevent it by closing the two doors attackers actually use (stolen identities and unpatched internet-facing systems), and by keeping backups the attacker cannot reach.

What is ransomware?

Ransomware is malware that denies an organisation access to its own data or systems and demands a payment to restore that access. The technical act is usually encryption of files on servers, endpoints and network shares. MITRE catalogues it as technique T1486, “Data Encrypted for Impact”. The commercial act is extortion, and encryption is only one of several levers attackers now pull.

Three variants account for almost everything you will meet in practice.

Type	What it does	What you lose	Main recovery lever
Crypto ransomware	Encrypts files and leaves a ransom note with a payment deadline	Access to data, and the systems that depend on it	Clean, offline backups
Locker ransomware	Locks the device or login screen without touching the files	Access to the device	Rebuild or reimage the endpoint
Data extortion without encryption	Steals data and threatens publication, no encryption step	Confidentiality, and control of the disclosure	None. Backups do not help here

That third row matters more every year. Sophos found encryption succeeded in 56% of attacks in its 2026 survey, up from 50%, but the cases where attackers skip encryption entirely and simply take the data are exactly the cases where a backup strategy provides no protection at all. Prevention and detection carry the load instead.

How a ransomware attack actually works

Encryption is the last step, not the first. By the time files start locking, an attacker has typically been inside the environment for weeks. Verizon’s 2026 report puts the median window between a credential being harvested by an infostealer and ransomware being deployed at 95 days. That is roughly three months in which a defender could have intervened.

A typical attack runs through seven stages:

1. Initial access. A valid credential is used, a phishing attachment is opened, or an internet-facing device is exploited. Frequently the access is bought rather than earned, from an initial access broker.
2. Foothold and persistence. A remote access tool or legitimate administration utility is installed so the attacker survives a reboot or a password change.
3. Discovery. The attacker maps the network, identity directory, file shares and, above all, the backup infrastructure.
4. Privilege escalation. Domain or tenant administrator rights are obtained, usually through credentials found on a compromised machine rather than through an exotic exploit.
5. Exfiltration. Sensitive data is copied out, often through legitimate cloud storage services so the traffic looks normal.
6. Backup destruction. Snapshots, shadow copies and online backup repositories are deleted or encrypted first. This step is deliberate and it is why “we have backups” is only true if the backups are unreachable from the network.
7. Encryption and the ransom note. Deployment is usually timed for a weekend or a public holiday, when staffing is thinnest.

Every one of the first six stages is detectable. That is the practical argument for detection and response coverage across identity, endpoint and cloud rather than a single perimeter product.

Double extortion, ransomware as a service, and why the model persists

Double extortion means the attacker encrypts your data and separately threatens to publish the copy they stole, so paying for a decryption key does not end the incident. ENISA describes the shift from exception to norm in its most recent Threat Landscape. Some groups add a third layer: contacting your customers, your regulator or your insurer directly to increase the pressure.

The reason this scales is that ransomware is sold as a service. One group builds and maintains the malware and the leak site. Affiliates rent it and carry out the intrusions, splitting the proceeds. Access itself is a separate market: Chainalysis reports that the average price paid to an initial access broker for access to a victim network fell from roughly $1,427 in early 2023 to about $439 by early 2026, as competition and automation drove the cost of a foothold down.

Law enforcement disrupts the brands but rarely the labour pool. After the takedowns and collapses of the last two years, displaced affiliates simply moved to whichever operation could absorb them. Industry tracking counted 146 active ransomware operations by mid-2026, with the five largest accounting for around 44% of published victims. For a defender, this means the specific group name in the ransom note is far less useful than the initial access vector it used.

How ransomware gets into a network

Identity is now the dominant way in. Sophos found that 79% of ransomware attacks in its 2026 survey began with an identity-based approach: a stolen or guessed credential, a phishing message that harvested one, or a session token taken by an infostealer. In 59% of those identity-related incidents, multi-factor authentication was not in place on the account that was abused.

Entry point	Share of ransomware attacks (Sophos, 2026)	What closes it
Malicious email	26%	Attachment and link detonation, plus user reporting that gets acted on
Phishing	24%	Phishing-resistant MFA, conditional access, credential monitoring
Compromised credentials	23%	MFA everywhere, privileged access separation, token protection
Exploited vulnerability	18%	Patching internet-facing devices first, on a fixed clock
Brute-force attack	6%	Lockout policies, removing direct RDP and VPN exposure

Verizon’s data looks different at first glance and it is worth understanding why. Across all breaches, not just ransomware, exploitation of vulnerabilities became the leading initial access vector in 2026 at 31%, overtaking credential abuse (13%) for the first time in the report’s nineteen-year history. Sophos surveys ransomware victims specifically; Verizon counts all breach types. Both point at the same short list. Verizon also found that 73% of ransomware victims had a related infostealer infection or credential leak in the preceding year, which ties the two findings together neatly: the credential is stolen quietly, then used later.

If your environment runs on Microsoft 365 and Entra ID, that is where most of this activity will appear first, in sign-in logs and token anomalies rather than in file-level alerts. Coverage of the Microsoft identity and endpoint stack is therefore not a nice-to-have in a ransomware defence.

What a ransomware attack costs in 2026

The ransom is rarely the largest number. Sophos puts the average recovery cost, excluding any ransom, at $1.7 million per incident in 2026, an increase of 11% year on year even as ransom payments fell. IBM’s Cost of a Data Breach Report, published on 29 July 2026, puts the global average cost of a breach at $4.99 million, up 12%, and records ransomware in 39% of the breaches it studied, up from 34%.

Measure	2026 figure	Source
Average recovery cost per incident, excluding ransom	$1.7 million, up 11% year on year	Sophos, State of Ransomware 2026
Median ransom paid, among organisations that paid	$769,000, down from $1 million in 2025	Sophos, State of Ransomware 2026
Median ransom paid, across all breach types	$139,875	Verizon DBIR 2026
Victims who did not pay	69%, up from 65%	Verizon DBIR 2026
Encrypted victims who recovered from backups	66%, up 12 percentage points	Sophos, State of Ransomware 2026
Global average cost of a data breach	$4.99 million, up 12%	IBM, Cost of a Data Breach 2026

Two of those numbers come from different populations and should not be compared directly: Verizon’s median covers every breach in its corpus, while the Sophos figure covers only mid-sized and large organisations that were surveyed after paying. Read as a trend rather than a benchmark, they agree. Sophos also reports that median ransom demands have fallen 65% over two years, and that 51% of organisations which paid negotiated the demand downwards first.

The macro picture confirms it. Chainalysis tracked roughly $820 million in on-chain ransomware payments during 2025, an 8% fall and the lowest annual total since 2021, while the share of victims paying anything at all dropped to a record low of about 28%. Attack volume did not fall with it: publicly claimed victims on leak sites rose by half, to 7,874. More attacks, less revenue. Attackers respond by attacking more often, which is precisely why prevention has to be treated as a standing programme rather than a project.

How to prevent ransomware

Prevention works, and the data now shows which controls carry the weight. The organisations that recovered without paying in 2026 did not have exotic technology. They had usable backups, multi-factor authentication on every account that mattered, and someone watching the alerts outside office hours.

1. Make one backup copy unreachable. Follow the 3-2-1 rule: three copies, on two different media, one of them offline or immutable. Attackers delete online backups as a deliberate step, so the offline or immutable copy is the one that decides whether you pay. Test a full restore on a schedule, because an untested backup is a hypothesis, not a control.
2. Put phishing-resistant MFA on everything. MFA was absent in 59% of identity-related ransomware incidents. Start with administrators, remote access, email and any account that can reach the backup system. Prefer hardware keys or passkeys over SMS codes.
3. Patch internet-facing systems on a clock. VPN concentrators, firewalls, remote access gateways and file transfer appliances are the devices attackers scan for. Vulnerability exploitation reached 31% of breaches in 2026. Set a hard deadline for edge devices, measured in days rather than quarters.
4. Watch for stolen credentials before they are used. Given the 95-day median gap between credential theft and ransomware deployment, monitoring for leaked corporate credentials and forcing rotation is one of the few controls that buys you months.
5. Segment the network and separate privilege. A flat network turns one compromised laptop into an enterprise outage. Administrators should hold separate accounts for administrative work, with no email and no browsing.
6. Deploy endpoint detection and response, and staff it. Detection without a response capability at 03:00 on a Sunday is a log file. Ransomware is deployed at weekends and holidays for exactly that reason.
7. Remove what you no longer need. Direct RDP exposure, legacy authentication protocols, dormant accounts and forgotten test servers are the assets that show up in the incident report.
8. Rehearse the incident response plan. Decide in advance who declares an incident, who talks to the regulator, who talks to customers, and where the plan is stored if the network is encrypted. Keep an offline copy.

What to do in the first 24 hours of a ransomware attack

Isolate before you investigate, and do not wipe anything. The most common avoidable mistakes in the first hours are reimaging machines that held the only forensic evidence, and paying before checking whether a free decryptor exists.

1. Isolate. Disconnect affected systems from the network. Do not power them off if you can avoid it, since memory can hold encryption keys and evidence.
2. Preserve. Keep forensic images, logs and the ransom note itself. Insurers, regulators and law enforcement will all ask for them.
3. Identify the strain. The ransom note and the file extension usually identify the family. Check the No More Ransom project, run jointly by Europol and the Dutch National Police with industry partners. Free decryptors exist for a meaningful share of families.
4. Assess the data theft. Establish what left the building. This determines your data protection notification duties, which are separate from your security incident duties.
5. Notify. Report to your national CSIRT or competent authority. Under Article 23 of the NIS2 Directive, in-scope entities owe an early warning within 24 hours of becoming aware of a significant incident, and a fuller notification within 72 hours. A ransomware attack is the textbook significant incident.
6. Restore in a clean environment. Rebuild rather than reuse. Restoring into an environment where the attacker still holds valid credentials is how organisations get encrypted twice.

If you are unsure whether those reporting deadlines apply to your organisation, our two-minute NIS2 applicability check resolves it quickly, and Who does NIS2 cover, and what you actually have to do covers the obligations that follow. Our NIS2 overview maps the directive onto the controls above.

Should you pay the ransom?

The consistent official position across the FBI, CISA and European agencies is that organisations should not pay. Payment does not guarantee recovery, funds the next wave of attacks, and marks you as a payer. The FBI notes that some victims were asked for more money after paying the original demand, and that flawed encryption in certain families means data can be unrecoverable even with a valid key.

There is also legal exposure. Several ransomware operations and individual operators are under sanctions in the US, UK and EU. Paying an entity on a sanctions list, or facilitating that payment, can create liability for the victim and for the negotiator.

The market has already moved in this direction. With about 28% of victims paying anything at all, non-payment is now the norm rather than an act of courage. If your organisation nonetheless faces the decision, treat it as a board-level legal question with counsel and law enforcement involved, not as an IT procurement decision. And check No More Ransom first.

Why shared defence beats solo defence

Ransomware affiliates reuse the same tooling and infrastructure across many victims, which means the second and third targets are attacked with indicators the first target already saw. Small and mid-sized organisations carry the worst of this asymmetry: they face the same affiliates as enterprises, with a fraction of the analysts.

That is the principle behind UnifiedONE’s shared defence intelligence: an attack investigated once in one member environment becomes a validated detection for every other member, usually within minutes. You can see how the platform applies this to Microsoft Defender, Entra ID and Sentinel, and how it is packaged for managed service providers and for smaller organisations without a dedicated security team.

Frequently asked questions

What is ransomware in simple terms?

Ransomware is software that criminals install on your systems to scramble your files so you cannot open them, then demand money for the key. Most attackers now also copy the files before scrambling them, so they can threaten to publish your data if you refuse to pay.

What is the difference between ransomware and malware?

Malware is the umbrella term for all malicious software, including viruses, spyware and infostealers. Ransomware is one category within it, defined by its goal: extortion. Many ransomware incidents begin with a different type of malware, typically an infostealer that quietly harvests credentials months earlier.

Can ransomware be removed?

The malware itself can be removed, but removal does not decrypt your files. Recovery comes from backups, from a free decryptor if one exists for that family, or, rarely, from a key obtained by paying. In practice, most organisations rebuild affected systems rather than clean them, because the attacker’s other access routes are hard to prove gone.

How long does recovery from a ransomware attack take?

It depends almost entirely on backup quality. Sophos found that 66% of organisations whose data was encrypted in 2026 recovered from backups, and recovery times have improved as backup practice has matured. Organisations without a tested offline copy routinely spend weeks, and average recovery costs, excluding any ransom, now stand at $1.7 million per incident.

Does antivirus stop ransomware?

Traditional signature-based antivirus stops known ransomware binaries, which is a shrinking part of the problem. Since 79% of attacks now start with a stolen or phished identity rather than a malicious file, prevention depends far more on multi-factor authentication, conditional access and behavioural detection across identity and endpoint than on the antivirus engine alone.

What is double extortion ransomware?

Double extortion is when attackers steal a copy of your data before encrypting it, then demand payment both to decrypt and to not publish the stolen copy. It is now standard practice. It also means backups alone no longer resolve an incident, because a good backup restores availability but does nothing about the stolen data.

Is it illegal to pay a ransomware ransom?

Paying is not automatically illegal in most jurisdictions, but it can be. Several ransomware operators and groups are under US, UK and EU sanctions, and paying a sanctioned entity, or helping someone else pay, can trigger civil or criminal liability. Separately, reporting duties such as the NIS2 24-hour and 72-hour deadlines apply whether or not you pay. Take legal advice before any payment.

In short

• Ransomware appeared in 48% of all breaches in Verizon’s 2026 data, and in 81.1% of cybercriminal incidents against EU organisations according to ENISA.
• Identity is the main door: 79% of attacks began with a stolen or phished credential, and MFA was missing in 59% of those cases.
• The ransom is not the main cost. Average recovery runs to $1.7 million per incident before any payment.
• Non-payment is now the majority behaviour, at roughly 69% of victims, and payment volumes have fallen to their lowest level since 2021.
• The controls that decide the outcome are unglamorous: an offline or immutable backup, phishing-resistant MFA, patched edge devices, and a response capability that works at the weekend.

Sources

1. Verizon, 2026 Data Breach Investigations Report, May 2026. Retrieved 8 August 2026.
2. Sophos, The State of Ransomware 2026, survey of 2,158 IT and cybersecurity leaders in 17 countries conducted by Vanson Bourne in Q1 2026. Retrieved 8 August 2026.
3. IBM Security, Cost of a Data Breach Report 2026, 29 July 2026. Retrieved 8 August 2026.
4. Chainalysis, Crypto Crime Report 2026: ransomware, February 2026. Retrieved 8 August 2026.
5. ENISA, ENISA Threat Landscape 2025, October 2025. Retrieved 8 August 2026.
6. CISA, FBI, NSA and MS-ISAC, #StopRansomware Guide. Retrieved 8 August 2026.
7. Europol and Dutch National Police, No More Ransom. Retrieved 8 August 2026.
8. MITRE ATT&CK, T1486: Data Encrypted for Impact. Retrieved 8 August 2026.
9. European Union, Directive (EU) 2022/2555 (NIS2), Article 23. Retrieved 8 August 2026.