A shocking number of businesses aren't getting their data back after a ransomware attack

Ransomware
(Image credit: Pixabay)

A vast majority of businesses that pay the demand following a ransomware attack don’t end up retrieving their encrypted and stolen data, a new report has claimed.

In its “State of data security by Rubrik Zero Labs: The hard truths of data security” report, based on a poll of more than 1,600 IT and security leaders (including CISOs and CIOs), the company found just 16% of global organizations that paid a ransom and received a decryptor actually managed to recover all of their data. 

To make matters worse, almost three-quarters (72%) of organizations reported paying their ransomware demand. 

Risking a lot

Together with phishing and business email compromise (BEC) attacks, ransomware is considered one of the most popular and destructive forms of cyberattack today. 

In ransomware attacks, a threat actor first steals, then encrypts, all of the sensitive data found across company endpoints. Then, it demands a payment be made in cryptocurrency (usually Monero, a type of cryptocurrency that’s very hard to trace), in exchange for the decryptor. The threat actor usually also threatens to release the stolen data on the dark web, unless its demands are met. That way, it looks to force the victim into making the payment even if the company has an up-to-date backup. 

Backups seem to be a popular countermeasure to ransomware. Almost all (99%) of eternal organizations reported having backup and recovery technology. However, 93% reported encountering “significant issues” with their solutions. Furthermore, nine out of ten reported malicious actors attempting to impact data backups during a cyberattack, and 73% were at least partially successful in doing so.

Cybersecurity experts and law enforcement agencies have warned against paying the ransom demand, for multiple reasons. Meeting the demand doesn’t guarantee the return of the file, nor does it guarantee the same attackers won’t strike the company again in a month. It also doesn’t guarantee security from other threat actors. At the same time, it motivates the cybercriminals to continue targeting businesses with ransomware, and even funds future cybercriminal campaigns. 

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Bad news - businesses who pay ransomware attackers aren’t very likely to get their data back
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
Less than half of ransomware incidents end in payment - but you should still be on your guard
A computer being guarded by cybersecurity.
The impact of the cyber insurance industry in resilience against ransomware
Representational image of a cybercriminal
Should ransomware payments be illegal?
ransomware avast
Ransomware attacks are costing Government offices a month of downtime on average
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
More reports claim 2024 was the worst year for ransomware attacks yet
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead