Whilst the report did not identify who had paid, the increase in those choosing to pay cybercriminals may be linked to the huge, headline grabbing, attacks last year on Jaguar Land Rover, Marks and Spencer and Co-op. Companies seeing the huge impact it had on these businesses’ ability to carry on their everyday business which resulted in a significant financial, reputational and regulatory consequences, may have been the catalyst for more to pay up.
Ransomware payments varied from $10,000 to more than $1million, with the average pay-out at $296,000. This is a real money earner for cybercriminals, and with an increasing number of businesses willing to pay out, we should expect to see no slowing down in the number of attacks in 2026.
However, 2026 is likely to see the continuation of a new tactic from cybercriminals, one that negates traditional methods of defending against a ransomware attack, as AJ Thompson, CCO at Northdoor plc explains:
"It is perhaps not surprising that we have seen an increase in the number of businesses paying out ransoms, when one looks at the high-profile attacks from 2025. Seeing the chaos caused will undoubtedly have made an impression on many, who have chosen to pay up rather than experience similar damage. Whilst the research highlights 24.3 per cent, this figure only represents those who have ’admitted’ paying, there may be many others who have kept quiet.
"From a UK perspective, the forthcoming Cyber Resilience Bill will force businesses to report any breach within 24 hours and within 72 hours provide a full, detailed explanation as to what has occurred. When this bill is introduced we are likely to see the number of companies admitting paying a ransom to increase.
"The issue for companies in 2026 is that cybercriminals have changed the way they are using ransomware. Instead of threatening to destroy data if a payment is not made, they are instead, hanging on to the data, threatening to leak it onto the dark web or making it publicly available.
"This is obviously a real issue for those who hold particularly sensitive data, such as the public sector, financial services, insurance and those holding payment and personal details. The nature of the way cybercriminals are using ransomware now, means that the traditional methods of defence are essentially, negated.
"Backing up data has always been the advice for those who want to ensure business continuity in the face of a ransomware attack. By having regular, secure back-ups, means systems can be quickly reestablished having a minimal impact on the business. However, as cybercriminals are no longer threatening to destroy data, but rather use it, back-ups cannot solve the issue.
"Instead, businesses need to have the ability to detect the movement of data in real-time. Solutions that identify when gigabytes of data are disappearing and immediately reporting it are a must. Stopping the data going in the first place has to be the priority rather than a reliance on back-ups.
"Equally, if the data stolen has been effectively encrypted, then it is all but worthless to the cybercriminal. Embedding security into the data layer, rather than just on the perimeter is another priority.
"Cybercriminals are going to be increasing their ransomware attacks over the coming months. Companies must get their houses to keep the criminals out and data safe. We have seen all too clearly the results of not doing so," Thompson concluded.
