Ransom Demands Are Down, Email Is The Top Way Attackers Get In
Help Net Security, Thursday, July 16th, 2026
Sophos research finds email and phishing cause half of ransomware incidents while median ransom demands fell to under $700,000.
Sophos surveyed 2,158 IT and security leaders and found malicious email and phishing together account for half of all ransomware incidents.
Stolen credentials remain the second-most common vector, with nearly 80% of attacks involving identity-based compromise.
Exploited software vulnerabilities declined from roughly one-third of attack vectors to 18%.
Recovery costs averaged $1.7 million, but median ransom demands dropped to just under $700,000, about two-thirds lower than two years earlier.
Backups proved critical to recovery, with two-thirds of victims successfully restoring encrypted data from them.