Security1 publisher2 min readPublished
Two reports price the average ransomware incident at 36 times the median ransom
The $5.08 million average comes from IBM and the $139,875 median from Verizon, one a mean and one a median across different samples, so 36 to 1 is an order of magnitude. Even discounted, the money sits in downtime.
The Watch · Security desk
What happened
- IBM's Cost of a Data Breach Report 2025 puts the average total cost of a ransomware incident at $5.08 million once downtime, remediation, legal work and business disruption are counted.
- The 2026 Verizon Data Breach Investigations Report puts the median ransom payment at $139,875, the figure BleepingComputer sets against IBM's cost average.
- Datto's State of BCDR Report 2025 found more than 60 percent of organizations believed they could recover from an incident in under a day, while only 35 percent did.
- GDPR gives 72 hours from the moment an organization becomes aware of a qualifying personal data breach, and the SEC gives public companies four business days for a material cybersecurity incident.
- Attackers increasingly target backup infrastructure during ransomware attacks, cutting the number of recovery options a victim has left.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Payment buys decryption keys, and that is all: the notification clocks run from awareness, so the legal, forensic and reporting work lands on the same schedule whether or not the ransom is paid.
- exposure Organizations counting backups as their recovery plan are counting an asset the attacker now goes looking for, and an unverified copy may not restore when it is needed.
- contradiction IBM and Verizon supply the numbers that size the problem; the recovery gap and the two-hour restore both come from Datto, which sells the remedy.
- cost Most of what makes up the $5.08 million lands on operations and finance, so the resilience case has to be argued in revenue terms to a CFO.
Set the two figures side by side and the ratio is 36 to 1, with the median ransom at roughly 2.8 percent of the average incident [11][12]. Both halves need a caveat before anyone spends against them. IBM reports an average, Verizon a median [1][2]. An average carries the catastrophic outliers a median discards, and the two numbers come out of separate studies with separate samples and different publication years [1]. Treat 36 to 1 as an order of magnitude, not a per-incident ratio.
Datto's own survey leaves a gap of at least 25 percentage points between the organizations that expect to recover inside a day and the ones that do [13]. Datto sells business continuity and disaster recovery products, and the case study at the end of the article comes from one of its MSP partners [9]. The cost figures are IBM's and Verizon's [1][2].
When backups are compromised, recovery adds forensic investigation, incident response specialists, system rebuilds and new software [8]. The tooling bought to shorten recovery is in scope for the attack.
Techify, a Datto MSP partner, took a call about a client hit through a compromised printer, restored 19 TB and had the business fully operational in under two hours with no ransom paid [9]. Nineteen terabytes inside 7,200 seconds works out to about 2.6 GB per second sustained [14]. A rate like that implies the business ran on recovery infrastructure while data moved back to production. Techify's method and the client's name stay out of the article.
The BleepingComputer piece calls recovery time a financial metric for mid-market businesses, not an IT one [18]. On the $5.08 million side of the ledger, the input a purchase order can move is hours of outage per critical system, and Datto's survey says the untested estimate of that number tends to be optimistic [3].
What to watch
- Whether IBM's next report breaks ransomware cost out by hours of downtime instead of one blended average.
- Independent measurement of achieved recovery times against stated RTOs, from a party that does not sell backup software.
- Whether the next DBIR reports what share of victims paid, so the $139,875 median can be sized against the population.