Ransomware remains one of the costliest threats to business, and the pattern is changing.

The numbers

– Volume is up. One tracker counted about 5,257 ransomware incidents in the first half of 2026, around 20% more than in the first half of 2025. The second quarter was slightly below the first, but activity remained elevated.

– Payments are down. Blockchain analytics firm Chainalysis reported that ransomware operators received about $820 million in on-chain payments in 2025, a decline, even as nearly 8,000 victims appeared on leak sites.

– Ransom amounts are falling on average. Sophos reported an average payment of about $1 million in 2025, roughly half the previous year’s figure.

What’s behind the shift

– More victims refuse to pay, helped by better backups and negotiation

– Attackers move toward volume, hitting many smaller organizations instead of a few large ones

– Cheaper access: Chainalysis found the average price for access to a victim fell sharply, from about $1,427 in early 2023 to about $439 in early 2026, as stolen-login pipelines and AI-assisted tools make break-ins cheaper

– Data theft extortion: many groups steal data and threaten to publish it, even without encrypting anything

Who is targeted

– Small and mid-sized businesses, which often have weaker defenses. Verizon’s 2025 breach report found ransomware present in a large majority of SMB breaches.

– Manufacturing, healthcare, education, and professional services

– Any organization with valuable data or costly downtime

How to defend

1. MFA on everything, especially email and remote access

2. Patch quickly, especially internet-facing systems

3. EDR with 24/7 monitoring

4. Offline or immutable backups, and test restores

5. Limit admin accounts and segment networks

6. Train staff to spot phishing

7. Prepare and rehearse your response plan

A realistic mindset

Lower payments don’t mean lower risk. They mean attackers are working faster and more broadly, so a small business is a more likely target than it was a few years ago.

Sources: Sophos (The State of Ransomware 2026), Verizon DBIR 2025, Check Point (2026 Ransomware Stats).

DBR Soft provides ransomware readiness reviews and managed protection. Contact us for more information.