State of Ransomware 2025 Findings Report

This document is a Sophos Whitepaper presenting the findings of the State of Ransomware 2025. The report is based on an independent survey conducted among 3,400 IT and cybersecurity leaders from various organizations impacted by ransomware over the previous year. The report outlines the evolving landscape of ransomware, detailing the causes and consequences experienced by organizations. It delves into the operational factors that contributed to vulnerabilities, the human impact on IT teams, and the economic aspects of ransomware, including ransom demands and payments. Key findings include the most common technical and operational causes of ransomware incidents, changes in data encryption rates, and trends in recovery costs and times. The report highlights insights into organizational challenges and the psychological effects on teams dealing with ransomware attacks. It also includes sector-based analysis and compares current findings with previous years to provide context to the ongoing battle against ransomware.