Last year’s ransomware data looked, briefly, like good news. Ransom payments fell roughly 35% in 2024, then another 8% in 2025, and some outlets called it a turning point, which is a reasonable thing to say about data that trends the right direction. The problem is that the payment number and the underlying threat are two different things, and reading one as evidence of the other is the mistake worth correcting before 2027.

Payments declined because organizations got better at saying no, not because attacks slowed or became less effective. Chainalysis reported that claimed ransomware attacks rose approximately 50% in the same period the payment totals were falling — not contradictory trends, but a business model finding its new equilibrium. Attackers responded by targeting more organizations and charging dramatically more when they do collect: the median ransom jumped from $12,738 in 2024 to roughly $59,556 in 2025. The groups collecting ransom are collecting more per incident; the groups running attacks are running more of them.

What the numbers actually tell you

The Verizon 2026 Data Breach Investigations Report found that ransomware now accounts for 48% of all data breaches globally, the highest share ever recorded. Black Kite tracked 7,551 ransomware victims in the prior year, up nearly 25%.

The number that matters most for any smaller business: 96% of ransomware victims in the Verizon data were small and medium-sized businesses. Not enterprises with dedicated security operations centers, just businesses with 10 employees and businesses with 400, holding real customer data and real reputational exposure without the recovery infrastructure that larger organizations take for granted.

The reason isn’t complicated. Smaller organizations tend to have more devices that go unmanaged, less rigorous credential management, and significantly less capacity to recover quickly. A group running ransomware against twenty smaller businesses consistently gets better returns than targeting one large organization that has Incident Response resources and legal counsel already on retainer. Declining payment rates haven’t changed that math.

How ransomware has changed, and why your current plan may not account for it

This is where the “good news” narrative becomes genuinely risky. If the takeaway from declining payments is that ransomware is losing steam, some organizations will deprioritize it, which is exactly the wrong read, because the tactics have evolved significantly and two of the most important shifts undercut the defenses smaller businesses most commonly rely on.

Backups are necessary. They’re no longer sufficient.

The original ransomware model was straightforward: encrypt the files, demand payment to unlock them, and a good backup solved it: restore, decline the ransom, move on. Attackers noticed. By 2025, roughly 77% of ransomware intrusions involved data theft alongside encryption, according to Deepstrike research. Where there used to be one threat, there are now two: locked systems and stolen data. Restoring from backup addresses the first and does nothing about the second.

In 2026, some groups skip encryption entirely and go straight to taking your data. They already have what they need before you know anything is wrong. The threat has shifted from “we’ll make your systems unusable” to “we’ll publish your customer list, your HR records, your most sensitive client data.” Backups are still essential, but they’re not the exit ramp they once were.

The extortion layers keep compounding.

Double extortion, steal data and encrypt systems, is now the baseline for most sophisticated ransomware groups. Triple extortion adds a third pressure point: contacting the victim’s customers, suppliers, or partners directly. Quadruple extortion layers on a denial-of-service attack timed to hit while recovery is underway. These are documented tactics running across dozens of active groups at scale, not hypothetical future scenarios, and “we have backups and we’d figure out the rest” isn’t a plan that matches what’s actually being deployed.

Should you pay the ransom?

This is the question where the answer depends on your company culture, your risk tolerance, what data may have been taken, and your regulatory obligations. There’s no universal right answer, and it’s a decision that belongs with your leadership team, ideally before it becomes urgent.

What the data shows: about half of businesses that pay receive functioning decryption tools, though a meaningful share get corrupted keys or find that recovery still takes weeks even with attacker cooperation. Paying also doesn’t guarantee that stolen data won’t be published; it reduces the probability, which matters, but it’s not the same as eliminating the exposure. And the ransom demand is usually the smallest number in the full cost of an incident; legal fees, regulatory notifications, customer communications, and recovery time tend to add up to significantly more regardless of whether a ransom is paid.

When our customers face this decision, we help them understand what’s actually on the table and the tradeoffs of paying vs. not paying so they can make an informed decision that fits their business’s values and mission. If paying becomes part of the conversation, it works better as one considered option within a broader response than as the plan itself.

What actually works for ransomware defense heading into 2027

The encouraging thing for smaller businesses is that you have structural advantages large organizations don’t. You move faster, have fewer systems to keep track of, and when everyone on the team knows who to call if something looks off, that’s a genuine defense. The human side of cybersecurity is where most ransomware intrusions begin anyway (a phishing email, a compromised credential, a click that someone in a hurry didn’t examine closely), and it’s significantly more accessible at smaller scale than the technology side.

Know what you have. You can’t manage what isn’t visible. A basic inventory of what’s on your network — what devices are connected, what software is installed, which accounts have access to what — is unglamorous work that closes real doors. A device that isn’t being tracked can’t be secured, and an account that was forgotten rather than formally deactivated is a door left open.

Treat data theft as the primary threat, not a secondary one. Think through what your most sensitive information is, where it lives, and who has access. Keeping only what you actually need reduces your exposure significantly. Data that isn’t there can’t be used against you.

Test your backups before you need them. Untested backups are faith-based recovery. Before an incident, know how long a full restore actually takes, what gets recovered and what doesn’t, and whether your backups are isolated from the systems they protect. A backup connected to a compromised network is a second copy of the problem.

Have your Incident Response sequence worked out before something happens. The decisions made in the first hour after discovering ransomware are disproportionately consequential. Who decides what? Who gets notified? Who contacts regulators? Who talks to customers? Organizations that have worked through these questions make significantly better decisions under pressure than those making it up in real time. If you want a structured way to practice this with your team, an Incident Response Tabletop exercise is exactly what it’s designed for — we put together a guide to running one before 2027.

Build a culture of security around Awareness Training. Ransomware intrusions most commonly start with a phishing email or a compromised credential. Awareness Training that reflects current tactics — not an annual checkbox exercise, but ongoing, practical context about what attackers are actually doing — is one of the highest-leverage investments a smaller organization can make. Phishing Testing helps close the gap between what people know in theory and what they actually click when something suspicious lands in their inbox.

Going into 2027

The ransomware headlines will keep moving, with payment totals fluctuating quarter to quarter and groups emerging and being disrupted, but the underlying dynamic doesn’t shift much with the news cycle. Smaller businesses remain a structurally attractive target, and the tactics continue to evolve faster than most defenses.

If you’d like to learn more about where your organization stands or talk with someone who can help you think through your cybersecurity, we’d welcome the conversation. Reach out and connect with us.

Frequently Asked Questions

Is ransomware still a threat to small businesses in 2026?
Yes. Verizon’s 2026 Data Breach Investigations Report found that 96% of ransomware victims were small and medium-sized businesses, and ransomware now accounts for 48% of all data breaches globally, the highest share on record.

Why are ransomware payments declining while attacks keep rising?
Fewer victims are choosing to pay, not because the attacks are less effective. Attackers responded by targeting more organizations and raising demands for those who do pay — the median ransom payment nearly quadrupled between 2024 and 2025.

Do backups protect against ransomware?
Partially. Backups address file encryption, but roughly 77% of ransomware attacks now involve data theft alongside encryption: attackers copy and remove your data before or instead of locking it. Backups cannot recover data that’s already been taken and threatened for publication.

What does ransomware recovery actually cost a small business?
Sophos research found the average recovery cost for businesses with 100–250 employees was $638,536 in 2025, excluding any ransom payment. That covers recovery, downtime, legal costs, and notification expenses — not the ransom itself.

What is double extortion ransomware?
Double extortion means attackers steal your data and encrypt your systems. They threaten both: pay or your files stay locked and your data gets published. Some groups in 2026 skip encryption entirely and go straight to the data theft threat — demanding payment in exchange for not publishing what they’ve already taken.