Nearly half of organisations falling victim to ransomware encryption pay up, says report—although half of those often negotiate the payment down first
Sophos has released its “State of Ransomware 2026” report, surveying 2,158 IT professionals and company executives about ransomware incidents and payment trends. The findings reveal that 48% of organizations whose data was encrypted by ransomware chose to pay their attackers rather than attempt recovery through alternative means.
The report shows a notable shift in ransom economics. The median ransom payment has declined to $769,000, down from $1 million in the previous year’s study, suggesting organizations may be achieving better negotiating positions or reflecting a change in attacker pricing strategies.
A particularly interesting finding is that approximately half of the organizations that paid ransom were able to negotiate the initial demand downward before making payment. This indicates that many victims treat the ransom as a negotiable figure rather than a fixed requirement, potentially resulting in significant aggregate savings across affected organizations.
The data presents a complex picture: ransomware remains a persistent and widespread threat to organizational security, yet the decreasing median payment amounts and successful negotiations suggest that awareness and response strategies may gradually be shifting the economics of these attacks. However, the continued payment by nearly half of affected organizations demonstrates that attackers still view ransomware as a profitable enterprise.