GITNUXREPORT 2026

Ransomware Attack Statistics

Global ransomware attacks soared dramatically in 2023, affecting many sectors and causing billions in damage.

Rajesh Patel

Team Lead & Senior Researcher with over 15 years of experience in market research and data analytics.

First published: Feb 13, 2026

Our Commitment to Accuracy

Rigorous fact-checking · Reputable sources · Regular updatesLearn more

Statistic 1

Average ransomware recovery cost for organizations was $2.73 million in 2023.

Statistic 2

Global ransomware payments totaled $1.1 billion in 2023, down 7% from 2022.

Statistic 3

US victims lost $12.5 billion to ransomware from 2018-2023 cumulatively.

Statistic 4

Healthcare ransomware costs averaged $10.93 million per breach in 2023.

Statistic 5

LockBit group extorted $91 million in 2023 from victims.

Statistic 6

Average downtime cost from ransomware was $1.85 million globally in 2023.

Statistic 7

Conti ransomware stole $180 million in crypto payments before disbanding in 2022.

Statistic 8

59% of ransomware victims paid average $1.54 million ransom in 2023.

Statistic 9

FBI reported $1.54 billion in ransomware losses in 2023 US complaints.

Statistic 10

Manufacturing sector ransomware costs hit $4.45 million average per incident 2023.

Statistic 11

Global insurance payouts for ransomware exceeded $1.5 billion in 2022.

Statistic 12

Average ransom demand in 2023 was $1.66 million worldwide.

Statistic 13

Colonial Pipeline paid $4.4 million ransom in 2021 incident.

Statistic 14

Change Healthcare ransomware cost Optum $872 million in 2024.

Statistic 15

Ransomware caused $20 billion annual global economic loss estimate for 2023.

Statistic 16

Education sector average ransomware cost: $1.85 million in 2023.

Statistic 17

DarkSide group ransoms totaled $90 million in 2021 before shutdown.

Statistic 18

Average recovery time cost businesses $8,440 per minute in 2023.

Statistic 19

US ransomware insurance claims rose 87% in 2023 to $1.3 billion.

Statistic 20

Phobos ransomware variants extorted $35 million from 2020-2023.

Statistic 21

Global ransomware economic impact projected at $265 billion by 2031.

Statistic 22

Retail ransomware average cost $3.31 million per attack in 2023.

Statistic 23

REvil group payments reached $200 million before 2021 takedown.

Statistic 24

Energy sector ransomware losses: $4.54 million average 2023.

Statistic 25

46% of victims paid ransom, averaging 40% of demand in 2023.

Statistic 26

Financial services ransomware cost $5.9 million average breach 2023.

Statistic 27

Maze ransomware leaked data from 140 victims, extorting $20M+ 2020.

Statistic 28

Healthcare paid 50% more in ransoms than average in 2023.

Statistic 29

Total US ransomware complaints losses: $20 million weekly average 2023.

Statistic 30

Government ransomware average cost $2.61 million in 2023.

Statistic 31

In 2023, ransomware attacks worldwide surged by 93% year-over-year, with over 4,800 incidents reported across multiple sectors.

Statistic 32

The United States experienced 1,300 ransomware attacks in 2023, accounting for 42% of global incidents.

Statistic 33

Ransomware detections rose 35% globally in Q1 2024 compared to Q1 2023, hitting 1.5 million unique victims.

Statistic 34

From January to June 2023, 2,243 ransomware victims were listed on leak sites, a 60% increase from 2022.

Statistic 35

In 2022, the FBI's IC3 received 2,365 ransomware complaints, up 13% from 2021.

Statistic 36

UK organizations faced 1,770 ransomware attacks in 2023, a 17% rise from the previous year.

Statistic 37

Ransomware incidents in healthcare reached 249 in 2023, doubling from 2022 levels.

Statistic 38

Global ransomware payments hit $1.1 billion in 2023, with a 7.3% decline from 2022 peak.

Statistic 39

EMEA region saw 1,200 ransomware incidents in H1 2024, up 25% YoY.

Statistic 40

Australia reported 487 ransomware attacks in 2023, affecting 20% more organizations than 2022.

Statistic 41

In 2023, 71% of surveyed organizations worldwide experienced at least one ransomware attack.

Statistic 42

Ransomware leak sites listed 2,755 victims in 2023, a record high.

Statistic 43

US critical infrastructure saw 300+ ransomware incidents in 2023 per CISA.

Statistic 44

France reported 450 ransomware attacks in 2023, up 30% from 2022.

Statistic 45

Global ransomware-as-a-service (RaaS) groups claimed responsibility for 80% of attacks in 2023.

Statistic 46

Ransomware incidents in Latin America jumped 150% in 2023 to 350 cases.

Statistic 47

In Q4 2023, ransomware detections worldwide increased 28% quarter-over-quarter.

Statistic 48

Canada logged 380 ransomware breaches in 2023, a 22% increase.

Statistic 49

Asia-Pacific ransomware attacks rose 40% in 2023, totaling 900 incidents.

Statistic 50

Ransomware hit 66% of mid-sized businesses globally in 2023 survey.

Statistic 51

EU nations reported 1,100 ransomware incidents in 2023 per ENISA.

Statistic 52

In 2022, global ransomware victims exceeded 4,000 per leak site monitoring.

Statistic 53

Ransomware alerts from CISA reached 1,200 in fiscal year 2023.

Statistic 54

Middle East ransomware incidents doubled to 250 in 2023.

Statistic 55

Africa saw 180 ransomware attacks in 2023, up 90% YoY.

Statistic 56

Global SMBs faced 2,100 ransomware attacks in 2023.

Statistic 57

Ransomware groups active in 2023 numbered over 150 worldwide.

Statistic 58

Q1 2024 saw 1,800 ransomware victims on dark web sites.

Statistic 59

Ransomware in government sector globally: 500 incidents in 2023.

Statistic 60

Worldwide, ransomware encrypt rate was 73% in successful attacks 2023.

Statistic 61

LockBit 3.0 was responsible for 25% of ransomware attacks in 2023.

Statistic 62

Phishing emails delivered 62% of initial ransomware access in 2023.

Statistic 63

RaaS model powered 75% of ransomware operations in 2023.

Statistic 64

Double extortion tactics used in 76% of attacks, adding data theft.

Statistic 65

Exploit of VPN vulnerabilities caused 32% of breaches in 2023.

Statistic 66

BlackCat/ALPHV claimed 10% of victim listings in 2023.

Statistic 67

RDP exploitation in 29% of ransomware entry points 2023.

Statistic 68

Clop exploited MOVEit vulnerability for 60+ victims in 2023.

Statistic 69

Triple extortion (encrypt, steal, DDoS) in 10% of attacks 2023.

Statistic 70

Akira variant emerged in 2023, targeting 50+ orgs via SMB exploits.

Statistic 71

55% of attacks involved living-off-the-land techniques in 2023.

Statistic 72

Rhysida ransomware hit 100 victims with data leaks in 2023.

Statistic 73

Supply chain attacks via third-parties: 15% of ransomware 2023.

Statistic 74

Play ransomware used in 40 high-profile attacks 2023.

Statistic 75

Initial access brokers sold access for $1,200 average in 2023.

Statistic 76

LockBit targeted Windows/Linux with Rust-based encryptors 2023.

Statistic 77

Medusa group used multi-extortion in 30 leaks 2023.

Statistic 78

40% of ransomware used Cobalt Strike for lateral movement 2023.

Statistic 79

BianLian exploited CVE-2023-34362 for 50+ victims.

Statistic 80

Encrypted C2 communication in 85% of ransomware implants 2023.

Statistic 81

DragonForce variant hit 20 orgs with wipers in 2023.

Statistic 82

Average time to encrypt network: 11 hours in 2023 attacks.

Statistic 83

Hive ransomware dismantled, but affiliates continued 20 attacks 2023.

Statistic 84

3AM group used Go-based malware for 15 extortions 2023.

Statistic 85

Quantum ransomware targeted backups in 25% of its 2023 ops.

Statistic 86

75% of organizations restored from backups without paying in 2023.

Statistic 87

Average recovery time from ransomware: 24 days globally in 2023.

Statistic 88

Only 10% of victims recovered fully without paying ransom 2023.

Statistic 89

MFA implementation reduced ransomware success by 99% in surveys 2023.

Statistic 90

37% of orgs had incident response plans tested pre-attack 2023.

Statistic 91

Backups offline/air-gapped prevented payment in 60% cases 2023.

Statistic 92

EDR tools detected 80% of ransomware pre-encryption in 2023.

Statistic 93

46% paid ransom despite backups due to data exfil fears 2023.

Statistic 94

Patch management within 7 days cut exploit risk by 90% 2023.

Statistic 95

Ransomware simulations trained 55% of orgs effectively 2023.

Statistic 96

Zero-trust architecture blocked 70% lateral movement 2023.

Statistic 97

Cyber insurance covered 40% of recovery costs average 2023.

Statistic 98

AI-driven threat hunting reduced dwell time to 3 days 2023.

Statistic 99

25% of victims used decryptors from NoMoreRansom project 2023.

Statistic 100

Network segmentation limited spread to 20% of assets 2023.

Statistic 101

Employee training reduced phishing success by 65% 2023.

Statistic 102

Immutable backups restored data in 85% of tested cases 2023.

Statistic 103

Law enforcement disrupted 15 RaaS groups in 2023 ops.

Statistic 104

XDR platforms accelerated response by 50% average 2023.

Statistic 105

62% of orgs improved resilience post-attack in 2023 survey.

Statistic 106

Dark web monitoring identified 70% of leaks pre-publication 2023.

Statistic 107

Cloud backup verification succeeded in 90% ransomware recoveries 2023.

Statistic 108

Incident response retainers activated within 1 hour for 40% 2023.

Statistic 109

Privilege access management prevented 55% escalation 2023.

Statistic 110

Post-quantum crypto prep aided 10% legacy recovery 2023.

Statistic 111

Collaborative intel sharing via ISACs mitigated 30% attacks 2023.

Statistic 112

Healthcare sector saw 67% of US ransomware attacks in Q1 2024.

Statistic 113

Manufacturing was targeted in 23% of global ransomware attacks in 2023.

Statistic 114

Education/Research sector hit by 18% of ransomware incidents worldwide 2023.

Statistic 115

US local governments faced 140 ransomware attacks in 2023.

Statistic 116

Financial services accounted for 12% of ransomware victims in H1 2023.

Statistic 117

Critical infrastructure (energy, water) saw 300 attacks in US 2023.

Statistic 118

Retail sector ransomware incidents rose 20% in 2023 to 250 cases.

Statistic 119

Professional services targeted in 16% of Sophos surveyed attacks 2023.

Statistic 120

Healthcare breaches: 249 US hospitals affected 2016-2023 cumulative.

Statistic 121

Construction industry ransomware attacks up 75% in 2023.

Statistic 122

Transportation/logistics hit by 9% of global ransomware 2023.

Statistic 123

K-12 schools in US: 180 ransomware incidents in 2023.

Statistic 124

Legal sector saw 150 ransomware attacks globally in 2023.

Statistic 125

Food/Agriculture: 7% of attacks, 100+ incidents 2023.

Statistic 126

Telecom sector ransomware: 80 incidents worldwide 2023.

Statistic 127

Non-profits/charities: 120 ransomware hits in 2023 survey.

Statistic 128

Pharmaceuticals: 45 ransomware attacks in 2023 globally.

Statistic 129

Media/Entertainment: 90 incidents, up 50% in 2023.

Statistic 130

Real Estate: 110 ransomware victims listed 2023.

Statistic 131

Emergency Services: 25 US incidents disrupting 911 in 2023.

Statistic 132

Casinos/Gaming: 15 major ransomware hits costing millions 2023.

Statistic 133

Veterinary/Animal Health: 40 attacks in 2023 US/UK.

Statistic 134

Libraries/Public Archives: 50 ransomware incidents 2023.

Statistic 135

Waste Management: 30 attacks globally 2023.

Statistic 136

Chemical sector: 35 ransomware breaches 2023.

1/136

Sources

Trusted by 500+ publications

+497

From a staggering 93% surge in global attacks to an unprecedented record of victims listed on leak sites, the relentless and costly escalation of ransomware in 2023 reveals a threat landscape that has fundamentally shifted, demanding a new level of vigilance and defense.

Key Takeaways

In 2023, ransomware attacks worldwide surged by 93% year-over-year, with over 4,800 incidents reported across multiple sectors.
The United States experienced 1,300 ransomware attacks in 2023, accounting for 42% of global incidents.
Ransomware detections rose 35% globally in Q1 2024 compared to Q1 2023, hitting 1.5 million unique victims.
Average ransomware recovery cost for organizations was $2.73 million in 2023.
Global ransomware payments totaled $1.1 billion in 2023, down 7% from 2022.
US victims lost $12.5 billion to ransomware from 2018-2023 cumulatively.
Healthcare sector saw 67% of US ransomware attacks in Q1 2024.
Manufacturing was targeted in 23% of global ransomware attacks in 2023.
Education/Research sector hit by 18% of ransomware incidents worldwide 2023.
LockBit 3.0 was responsible for 25% of ransomware attacks in 2023.
Phishing emails delivered 62% of initial ransomware access in 2023.
RaaS model powered 75% of ransomware operations in 2023.
75% of organizations restored from backups without paying in 2023.
Average recovery time from ransomware: 24 days globally in 2023.
Only 10% of victims recovered fully without paying ransom 2023.

Global ransomware attacks soared dramatically in 2023, affecting many sectors and causing billions in damage.

Financial Impact

Average ransomware recovery cost for organizations was $2.73 million in 2023.
Global ransomware payments totaled $1.1 billion in 2023, down 7% from 2022.
US victims lost $12.5 billion to ransomware from 2018-2023 cumulatively.
Healthcare ransomware costs averaged $10.93 million per breach in 2023.
LockBit group extorted $91 million in 2023 from victims.
Average downtime cost from ransomware was $1.85 million globally in 2023.
Conti ransomware stole $180 million in crypto payments before disbanding in 2022.
59% of ransomware victims paid average $1.54 million ransom in 2023.
FBI reported $1.54 billion in ransomware losses in 2023 US complaints.
Manufacturing sector ransomware costs hit $4.45 million average per incident 2023.
Global insurance payouts for ransomware exceeded $1.5 billion in 2022.
Average ransom demand in 2023 was $1.66 million worldwide.
Colonial Pipeline paid $4.4 million ransom in 2021 incident.
Change Healthcare ransomware cost Optum $872 million in 2024.
Ransomware caused $20 billion annual global economic loss estimate for 2023.
Education sector average ransomware cost: $1.85 million in 2023.
DarkSide group ransoms totaled $90 million in 2021 before shutdown.
Average recovery time cost businesses $8,440 per minute in 2023.
US ransomware insurance claims rose 87% in 2023 to $1.3 billion.
Phobos ransomware variants extorted $35 million from 2020-2023.
Global ransomware economic impact projected at $265 billion by 2031.
Retail ransomware average cost $3.31 million per attack in 2023.
REvil group payments reached $200 million before 2021 takedown.
Energy sector ransomware losses: $4.54 million average 2023.
46% of victims paid ransom, averaging 40% of demand in 2023.
Financial services ransomware cost $5.9 million average breach 2023.
Maze ransomware leaked data from 140 victims, extorting $20M+ 2020.
Healthcare paid 50% more in ransoms than average in 2023.
Total US ransomware complaints losses: $20 million weekly average 2023.
Government ransomware average cost $2.61 million in 2023.

Financial Impact Interpretation

While ransomware gangs may consider themselves entrepreneurs of extortion, the sobering truth is they've built a grotesquely efficient global economy where the cost of doing business is measured in billions lost, critical systems paralyzed, and a perverse market logic forcing nearly half of desperate victims to pay a king's ransom just to survive.

Global Incidence

In 2023, ransomware attacks worldwide surged by 93% year-over-year, with over 4,800 incidents reported across multiple sectors.
The United States experienced 1,300 ransomware attacks in 2023, accounting for 42% of global incidents.
Ransomware detections rose 35% globally in Q1 2024 compared to Q1 2023, hitting 1.5 million unique victims.
From January to June 2023, 2,243 ransomware victims were listed on leak sites, a 60% increase from 2022.
In 2022, the FBI's IC3 received 2,365 ransomware complaints, up 13% from 2021.
UK organizations faced 1,770 ransomware attacks in 2023, a 17% rise from the previous year.
Ransomware incidents in healthcare reached 249 in 2023, doubling from 2022 levels.
Global ransomware payments hit $1.1 billion in 2023, with a 7.3% decline from 2022 peak.
EMEA region saw 1,200 ransomware incidents in H1 2024, up 25% YoY.
Australia reported 487 ransomware attacks in 2023, affecting 20% more organizations than 2022.
In 2023, 71% of surveyed organizations worldwide experienced at least one ransomware attack.
Ransomware leak sites listed 2,755 victims in 2023, a record high.
US critical infrastructure saw 300+ ransomware incidents in 2023 per CISA.
France reported 450 ransomware attacks in 2023, up 30% from 2022.
Global ransomware-as-a-service (RaaS) groups claimed responsibility for 80% of attacks in 2023.
Ransomware incidents in Latin America jumped 150% in 2023 to 350 cases.
In Q4 2023, ransomware detections worldwide increased 28% quarter-over-quarter.
Canada logged 380 ransomware breaches in 2023, a 22% increase.
Asia-Pacific ransomware attacks rose 40% in 2023, totaling 900 incidents.
Ransomware hit 66% of mid-sized businesses globally in 2023 survey.
EU nations reported 1,100 ransomware incidents in 2023 per ENISA.
In 2022, global ransomware victims exceeded 4,000 per leak site monitoring.
Ransomware alerts from CISA reached 1,200 in fiscal year 2023.
Middle East ransomware incidents doubled to 250 in 2023.
Africa saw 180 ransomware attacks in 2023, up 90% YoY.
Global SMBs faced 2,100 ransomware attacks in 2023.
Ransomware groups active in 2023 numbered over 150 worldwide.
Q1 2024 saw 1,800 ransomware victims on dark web sites.
Ransomware in government sector globally: 500 incidents in 2023.
Worldwide, ransomware encrypt rate was 73% in successful attacks 2023.

Global Incidence Interpretation

With ransomware doubling its auditions for the villain of the year across every sector and continent, paying a tithe to digital extortionists is becoming as routine as a monthly subscription, yet the sheer scale of this parasitic industry somehow still manages to underwhelm our collective will to stop it.

Ransomware Variants and Methods

LockBit 3.0 was responsible for 25% of ransomware attacks in 2023.
Phishing emails delivered 62% of initial ransomware access in 2023.
RaaS model powered 75% of ransomware operations in 2023.
Double extortion tactics used in 76% of attacks, adding data theft.
Exploit of VPN vulnerabilities caused 32% of breaches in 2023.
BlackCat/ALPHV claimed 10% of victim listings in 2023.
RDP exploitation in 29% of ransomware entry points 2023.
Clop exploited MOVEit vulnerability for 60+ victims in 2023.
Triple extortion (encrypt, steal, DDoS) in 10% of attacks 2023.
Akira variant emerged in 2023, targeting 50+ orgs via SMB exploits.
55% of attacks involved living-off-the-land techniques in 2023.
Rhysida ransomware hit 100 victims with data leaks in 2023.
Supply chain attacks via third-parties: 15% of ransomware 2023.
Play ransomware used in 40 high-profile attacks 2023.
Initial access brokers sold access for $1,200 average in 2023.
LockBit targeted Windows/Linux with Rust-based encryptors 2023.
Medusa group used multi-extortion in 30 leaks 2023.
40% of ransomware used Cobalt Strike for lateral movement 2023.
BianLian exploited CVE-2023-34362 for 50+ victims.
Encrypted C2 communication in 85% of ransomware implants 2023.
DragonForce variant hit 20 orgs with wipers in 2023.
Average time to encrypt network: 11 hours in 2023 attacks.
Hive ransomware dismantled, but affiliates continued 20 attacks 2023.
3AM group used Go-based malware for 15 extortions 2023.
Quantum ransomware targeted backups in 25% of its 2023 ops.

Ransomware Variants and Methods Interpretation

The sobering takeaway from 2023's ransomware chaos is that while law enforcement can dismantle one group like Hive, the thriving criminal ecosystem of Ransomware-as-a-Service, phishing emails, and purchased access means the problem has metastasized into a slick, corporate plague where encryption is just the opening act.

Recovery and Mitigation

75% of organizations restored from backups without paying in 2023.
Average recovery time from ransomware: 24 days globally in 2023.
Only 10% of victims recovered fully without paying ransom 2023.
MFA implementation reduced ransomware success by 99% in surveys 2023.
37% of orgs had incident response plans tested pre-attack 2023.
Backups offline/air-gapped prevented payment in 60% cases 2023.
EDR tools detected 80% of ransomware pre-encryption in 2023.
46% paid ransom despite backups due to data exfil fears 2023.
Patch management within 7 days cut exploit risk by 90% 2023.
Ransomware simulations trained 55% of orgs effectively 2023.
Zero-trust architecture blocked 70% lateral movement 2023.
Cyber insurance covered 40% of recovery costs average 2023.
AI-driven threat hunting reduced dwell time to 3 days 2023.
25% of victims used decryptors from NoMoreRansom project 2023.
Network segmentation limited spread to 20% of assets 2023.
Employee training reduced phishing success by 65% 2023.
Immutable backups restored data in 85% of tested cases 2023.
Law enforcement disrupted 15 RaaS groups in 2023 ops.
XDR platforms accelerated response by 50% average 2023.
62% of orgs improved resilience post-attack in 2023 survey.
Dark web monitoring identified 70% of leaks pre-publication 2023.
Cloud backup verification succeeded in 90% ransomware recoveries 2023.
Incident response retainers activated within 1 hour for 40% 2023.
Privilege access management prevented 55% escalation 2023.
Post-quantum crypto prep aided 10% legacy recovery 2023.
Collaborative intel sharing via ISACs mitigated 30% attacks 2023.

Recovery and Mitigation Interpretation

Your backups, MFA, and quick patching give you a fighting chance, but ransomware still wins the war when fear forces a payment or sluggish recovery lets it cripple your operations for nearly a month.

Sector-Specific Attacks

Healthcare sector saw 67% of US ransomware attacks in Q1 2024.
Manufacturing was targeted in 23% of global ransomware attacks in 2023.
Education/Research sector hit by 18% of ransomware incidents worldwide 2023.
US local governments faced 140 ransomware attacks in 2023.
Financial services accounted for 12% of ransomware victims in H1 2023.
Critical infrastructure (energy, water) saw 300 attacks in US 2023.
Retail sector ransomware incidents rose 20% in 2023 to 250 cases.
Professional services targeted in 16% of Sophos surveyed attacks 2023.
Healthcare breaches: 249 US hospitals affected 2016-2023 cumulative.
Construction industry ransomware attacks up 75% in 2023.
Transportation/logistics hit by 9% of global ransomware 2023.
K-12 schools in US: 180 ransomware incidents in 2023.
Legal sector saw 150 ransomware attacks globally in 2023.
Food/Agriculture: 7% of attacks, 100+ incidents 2023.
Telecom sector ransomware: 80 incidents worldwide 2023.
Non-profits/charities: 120 ransomware hits in 2023 survey.
Pharmaceuticals: 45 ransomware attacks in 2023 globally.
Media/Entertainment: 90 incidents, up 50% in 2023.
Real Estate: 110 ransomware victims listed 2023.
Emergency Services: 25 US incidents disrupting 911 in 2023.
Casinos/Gaming: 15 major ransomware hits costing millions 2023.
Veterinary/Animal Health: 40 attacks in 2023 US/UK.
Libraries/Public Archives: 50 ransomware incidents 2023.
Waste Management: 30 attacks globally 2023.
Chemical sector: 35 ransomware breaches 2023.

Sector-Specific Attacks Interpretation

The ransomware epidemic has evolved from a random shakedown into a disturbingly organized form of industrial sabotage, surgically targeting the very pillars of our society—from our hospitals and schools to our power grids and food supply—revealing that our critical infrastructure is now the most critical business model for digital extortionists.

Sources & References

Logos provided by Logo.dev