More than half (58%) of retailers hit by ransomware pay the ransom, according to new research, which also found ransom demands have doubled and nearly half of retailers traced their ransomware incidents to security gaps they were unaware existed 

The findings are from the fifth annual Sophos State of Ransomware in Retail report, a vendor-agnostic survey of IT and cybersecurity leaders across 16 countries.

Chester Wisniewski, director, global field CISO, Sophos, says retailers globally are facing a more complex threat landscape where adversaries are constantly on the lookout for and exploiting existing vulnerabilities, most frequently in remote access and internet facing networking equipment.

“Now, with ransom demands reaching new highs, the need to implement comprehensive security strategies is even more apparent,” he said.

“Without this, retailers risk ongoing operational disruption and lasting reputational damage that could take years to repair. Encouragingly, many are beginning to recognise this and respond by investing in their cyber defences, enabling them to stop attacks before they escalate and recover faster.” 

Key findings

The report revealed:

• 46% of attacks began with an unknown security gap (top operational factor) 
• 30% of attacks exploited known vulnerabilities (top technical root cause, third year running) 
• 58% of victims with encrypted data paid; 48% of attacks resulted in encryption (five-year low) 
• Median ransom demand doubled to $2 million from 2024; average payment increased 5% to $1 million 

Alongside these challenges, there are also signs of progress. The percentage of attacks stopped before encryption reached a five-year high, indicating that retail organisations are improving their ability to detect and neutralise attacks swiftly. The data encryption rate is at its lowest level in five years, with only 48% of attacks now resulting in data encryption.  

While the average retail ransom payment has risen by 5% ($1m in 2025, up from $950k in 2024), the average ransom payment is half the average ransom demand, suggesting that retail organisations are becoming more resistant to inflated ransom demands and are potentially seeking expert advice to navigate ransomware attacks.   “In the end, successful security programs are focused on risk management. To assess and manage those risks, retailers must have visibility into the threats they face as well as their assets and their security posture. Organisations that combine strong asset management and patching with Managed Detection and Response services and managed risk services prevent more and recover faster, taking a proactive approach in their cyber defences.”