A ransomware attack is a cyberattack that locks an organization's files with encryption, often while stealing a copy of the data first, then demands payment to restore access and keep the stolen data from being published. Ransomware showed up in 48% of data breaches analyzed in 2026, up from 44% a year earlier, according to Verizon's 2026 Data Breach Investigations Report. The attack itself has split into two threats that run together: encryption, which blocks access to files, and theft, which gives attackers a second lever even if backups make encryption recoverable. Recovery options now range from free decryption tools to paying a ransom that averaged over $1 million per incident in one 2025 quarter, so the path a victim takes depends heavily on what was actually taken and what was prepared in advance.
Table of Contents
- How Encryption and Theft Work Together Now
- Who Is Being Targeted
- Should You Pay the Ransom?
- Free Recovery Options Before Considering Payment
- Preventing an Attack Before It Happens
- Frequently Asked Questions
How Encryption and Theft Work Together Now
Early ransomware simply encrypted files and demanded payment for the decryption key. Modern attacks add a second step: before encrypting anything, the attacker copies sensitive files to their own servers. This is called double extortion, and it means a victim with perfect backups can still be pressured to pay, because refusing does not stop the stolen data from being leaked or sold.
The Medusa ransomware operation illustrates this pattern directly. A joint advisory from CISA, the FBI, and the Department of Health and Human Services, updated August 18, 2026, describes Medusa affiliates encrypting victims' files while threatening to publish stolen data, and reports more than 500 victims across multiple critical sectors as of April 2026, according to the CISA advisory AA25-071A. This shift toward data theft also changed the economics of an attack. Coveware by Veeam attributed a sharp rise in payouts during the second quarter of 2025 specifically to "attacks built around stealing data rather than encrypting it," noting the average ransom payment reached $1.13 million, up 104% from the prior quarter, according to Coveware's Q2 2025 report.
Who Is Being Targeted
Ransomware now reaches nearly every sector of the economy. The FBI's 2025 Internet Crime Report found that 14 of 16 designated critical infrastructure sectors reported at least one ransomware victim during the year, and identified 63 new ransomware variants in circulation, according to the FBI IC3 2025 report. Healthcare bore the heaviest load. It was the most-targeted U.S.
critical infrastructure sector in 2025, with 278 tracked ransomware attacks, the same FBI report found. That concentration matters because hospitals and clinics often cannot delay operations while recovering from encryption, which makes them more likely to feel pressure to pay quickly. The FBI also logged 3,611 ransomware complaints in 2025 tied to over $32 million in reported losses, up from 3,156 complaints and about $12 million in 2024. That is a 14% rise in complaint volume alongside a near-tripling of reported losses, pointing to attacks that cost victims more even where the number of incidents grew more modestly.
Should You Pay the Ransom?
Most victims now refuse. Verizon's 2026 report found that 69% of affected organizations declined to pay, and Coveware's quarterly tracking shows the share of victims who pay has fallen to roughly 23-28%, down from about 85% in 2019, according to Coveware's 2025-2026 reports. Incident-response firms attribute the decline to wider use of offline backups and to insurer and government guidance discouraging payment. That guidance has not eliminated the money flowing to attackers, but it has reduced it.
On-chain ransomware payments totaled roughly $820 million in 2025, an 8% drop from a revised $892 million in 2024, even as the number of claimed attacks rose about 50%, according to Chainalysis's 2026 Crypto Crime Report. More victims are being hit, but a shrinking share of them are paying. Paying does not guarantee a clean outcome. It funds the same groups that will likely target victims again, and it provides no assurance that stolen data will actually be deleted rather than resold. The decision to pay should come only after exhausting free recovery options and the operational alternative of rebuilding from backups.
- Before paying, confirm whether data was actually encrypted, stolen, or both — the two demand different responses.
- Check whether a free decryption tool already exists for the specific ransomware family.
- Involve law enforcement and, where applicable, an incident-response firm before any payment decision.
- Weigh legal and insurance guidance, since some insurers now discourage or restrict ransom payments.
Free Recovery Options Before Considering Payment
A victim's first move should be checking for a no-cost fix. The No More Ransom project, a partnership between Europol, the Dutch police, McAfee, and Kaspersky, has published more than 136 decryption tools covering more than 165 ransomware families, and reports helping over 1.5 million people recover files without paying, according to Europol's announcement. These tools work only when a victim's specific ransomware variant has already been cracked by researchers, so identifying the exact strain matters before assuming no fix exists.
A file's ransom note or the extension added to encrypted files usually names the variant, which can then be checked against the No More Ransom catalog. Where no free tool exists, recovery falls back to offline backups, which is why backup strategy matters more than any after-the-fact decision. A clean, disconnected backup restores operations without negotiating with an attacker or risking a second extortion attempt tied to stolen data.
Preventing an Attack Before It Happens
CISA's #StopRansomware guide, maintained jointly with the FBI, NSA, and the Multi-State Information Sharing and Analysis Center, lays out the core defenses against both encryption and data-theft extortion, according to CISA's StopRansomware Guide. These four measures target both halves of the modern attack.
Offline backups blunt the encryption threat by making recovery possible without a decryption key. MFA, patching, and segmentation reduce the chance an attacker gets far enough inside to steal data in the first place, which is the step double extortion depends on.
- Maintain offline, encrypted backups and test them regularly — a backup that has never been restored is unverified.
- Patch internet-facing systems promptly, since unpatched software is a common entry point.
- Enforce phishing-resistant multi-factor authentication on all accounts with network access.
- Segment networks so a breach in one system cannot spread unchecked to the rest of the organization.
Frequently Asked Questions
What is the difference between ransomware encryption and ransomware data theft?
Encryption locks files so they cannot be opened; data theft copies files to the attacker's own servers before encryption happens, creating a second threat — public leak — that persists even if backups restore access.
Does paying a ransom guarantee stolen data gets deleted?
No. The research packet does not document any guarantee of this, and the falling share of victims who pay reflects advice from insurers and government agencies against relying on attacker promises.
How can I tell if a free decryption tool exists for my situation?
Identify the ransomware variant from the ransom note or the file extension added to encrypted files, then check that name against the No More Ransom project's catalog of more than 165 covered families.
You Might Also Like
- Ransomware Recovery Risk Guide: Data Exposed, Fraud, and Identity Theft
- FBI Ransomware Prevention Guide: Controls, Monitoring, and Recovery
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks