Sophos 2026 Ransomware Report: Email Leads Attack Vectors as Encryption Rates Rise
Summary
Sophos surveyed 2,158 ransomware victims across 17 countries. Email-based attacks accounted for half of reported root causes, while data encryption rose to 56%. Median ransom payments fell to $769,000, but average recovery costs reached $1.7 million.
Key points
- Vanson Bourne conducted the Sophos-commissioned survey in Q1 2026, covering organizations with 100–5,000 employees that experienced ransomware during the preceding 12 months.
- Respondents attributed 26% of incidents to malicious email, 24% to phishing, and 23% to compromised credentials; exploited vulnerabilities fell from 32% in 2025 to 18%.
- Among victims reporting compromised credentials as the root cause, 97% had MFA enabled in some capacity; this does not establish whether MFA covered the compromised access point.
- Data was encrypted in 56% of incidents, up from 50% last year; 16% of all incidents involved both encryption and data theft.
- Among organizations with encrypted data, 66% used backups for recovery and 48% paid a ransom. The median reported payment fell from $1 million to $769,000.
- Average recovery costs excluding ransom rose 11% to $1,700,200, while the median remained $375,000.
- The report recommends comprehensive identity controls, stronger email defenses, tested offline or immutable backups, exposure management, and integrated security telemetry.
Article Details
- Publisher
- Sophos
- Report Period
- Survey conducted January–March 2026, covering respondents' previous 12 months.
- Scope
- Global, vendor-agnostic survey of ransomware experiences at organizations with 100–5,000 employees across 17 countries and 15 industry sectors.
- Sample Size
- 2,158 IT and cybersecurity decision-makers at organizations hit by ransomware; survey conducted by Vanson Bourne.
- Key Statistics
- Among 2,158 ransomware victims, malicious email accounted for 26% of reported root causes, phishing 24%, compromised credentials 23%, and exploited vulnerabilities 18%.
- Among 503 respondents whose attacks originated with compromised credentials, 97% reported MFA enabled in some capacity; this does not establish comprehensive MFA coverage.
- 56% of surveyed ransomware incidents encrypted data, including 16% involving both encryption and theft, compared with a 50% encryption rate in the 2025 report.
- Among 1,214 organizations with encrypted data, 66% used backups and 48% paid a ransom to recover data; multiple responses were permitted.
- Mean recovery cost excluding ransom was $1,700,200 across 2,158 victims, up 11% from the 2025 report; median recovery cost was $375,000.
- Recommendations
- Prioritize identity threat detection and response, enforce MFA across all access points, and regularly audit human and non-human credentials.
- Deploy advanced email filtering, implement DMARC/DKIM/SPF, and provide regular phishing awareness training.
- Regularly test backups, store them offline or in immutable formats, and integrate recovery into a documented incident response plan.
- Rapidly update firewalls, minimize internet-facing administrative access and user portals, and integrate firewall telemetry with XDR or MDR.
- Use specialist or MDR support to address security staffing and expertise gaps when adequate in-house coverage is unavailable.
MITRE ATT&CK
T1078 · Valid AccountsCompromised credentials were reported as the root cause of 23% of ransomware incidents and were used against exposed applications, firewalls, VPNs, and IoT devices.T1110 · Brute ForceBrute force attacks accounted for 6% of reported ransomware root causes.T1486 · Data Encrypted for ImpactRespondents reported that ransomware successfully encrypted organizational data in 56% of incidents.T1566 · PhishingRespondents identified phishing and malicious email as leading ransomware entry vectors.
Countries
Australia17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Brazilthat had been hit by ransomware in the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan,Chilehad been hit by ransomware in the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore,Colombiahit by ransomware in the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, SouthFrancein the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Germany12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.IndiaUSA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Italymonths were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.JapanUSA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Mexicoransomware in the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, andSingaporeChile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.South AfricaColombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Spainwere interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.Switzerlandacross 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.UAEUK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.United Kingdomin the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan, Singapore, South Africa, and UAE.United Statesthat had been hit by ransomware in the previous 12 months were interviewed across 17 countries: USA, Brazil, Chile, Colombia, Mexico, UK, France, Germany, Italy, Spain, Switzerland, Australia, India, Japan,
Industries
Business and professional services| **Business and professional services** | 42% |Central/federal government| **Central/federal government** | 54% |Construction and property| **Construction and property** | 39% |Distribution and transport| **Distribution and transport** | 53% |Education (lower)| **Education (lower)** | 43% |Energy, oil/gas, and utilities| **Energy, oil/gas, and utilities** | 47% |Financial Services| **Financial services** | 50% |Healthcare| **Healthcare** | 45% |Higher Education| **Higher education** | 51% |IT, technology and telecoms| **IT, technology, and telecoms** | 40% |Local/state governmentLocal/state government (72%) and media, leisure, and entertainment (64%) were most likely to pay the ransom, reporting more than double the rate of retail (32%).Manufacturing| **Manufacturing** | 43% |Media, leisure and entertainmentLocal/state government (72%) and media, leisure, and entertainment (64%) were most likely to pay the ransom, reporting more than double the rate of retail (32%).Retail> **Retail** was the sector with the lowest occurrence of paying ransomware attackers (**32%**).