State of Ransomware in Financial Services 2025

This document is a whitepaper that presents findings from an independent survey conducted among 369 IT and cybersecurity leaders in the financial services sector across 17 countries, focusing on ransomware incidents experienced in the previous year. The report outlines the evolution of ransomware attacks on financial services providers, detailing the causes, consequences, and operational factors contributing to their vulnerability. Key findings indicate that exploited vulnerabilities are the leading cause of attacks, with malicious emails and credential-based attacks following. The report also discusses the impact of ransomware on data, including encryption rates and recovery statistics. Additionally, it highlights ransom demands and payments, noting a significant increase in median ransom amounts. The human impact on IT and cybersecurity teams is documented, revealing increased stress, workload, and changes in team dynamics following ransomware incidents. The whitepaper aims to provide a comprehensive understanding of the current ransomware landscape within the financial services industry.