The State of Ransomware in Financial Services 2026
Sophos, Thursday, November 5th, 2026
Sophos' 2026 financial services ransomware report finds lower ransom demands and payments but slower recovery and higher team stress.
Sophos surveyed 177 IT and security leaders at banking, financial services and insurance organizations hit by ransomware in the past year.
Median ransom demands fell from $3 million to $1 million and median payments declined to $1.07 million, but recovery took a week longer and the median recovery cost of $750,000 was double the cross-sector median.
Identity-based vectors started 85% of attacks, 44% of victims cited a known but unaddressed security gap, and 59% of attacks encrypted data, with 75% restoring from backups.
52% of teams reported increased anxiety about future attacks, the highest of any sector, and 70% of credential-based attack victims were encrypted despite having MFA.