Financial Services Ransomware Statistics
7% of reported cybercrime cases in Africa in 2025 involved ransomware or Banking Trojan stealers.
Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.
Financial losses totalling around £270,000 were reported by UK organisations that experienced ransomware last year, a 50 per cent increase compared to previous year.
Average ransom payment dropped to $2.8 million, down from $3.6 million in 2025.
83% of ransomware victims paid a ransom, up from 70% previously.
Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.
Qilin was responsible for 59 finance-sector incidents in the past year.
Reported ransomware incidents targeting finance increased 30% from 2024 to 2025.
Banks reported 71 ransomware disclosures in 2023 compared to 44 disclosures by investment firms, while by 2025 banks fell to 36 disclosures and investment firms rose to 84 disclosures (41.6% of all incidents).
Ransomware payouts now average $40 million, nearly triple their level in 2024.
When identity breaches impact business, the primary consequences are data theft (49%), ransomware (48%), and financial theft (47%).
Small businesses incured at least $131 billion in losses from fraud, scams, and ransomware last year.
The average ransom demand exceeded $1,028,214 in Q1 2026.
Ransomware accounted for about 90% of total incurred losses in Resilience's manufacturing insurance portfolio over the past five years.
In 2025, ransomware accounted for 36% of security incidents affecting financial institutions.
In 2025, approximately 12.8% of B2B financial organizations experienced ransomware.
In 2025, total ransomware payments fell 23%.
Individual extortion demands in healthcare reached as high as $4 million in the first half of 2025.
Nearly half of the active malware families have financial extortion capabilities, including ransomware that can encrypt files on the device.
The manufacturing industry accounted for 456 ransomware incidents totaling approximately $284.6 million in reported payments, while the financial services industry accounted for 432 incidents totaling approximately $365.6 million, and the healthcare industry accounted for 389 incidents totaling approximately $305.4 million.
51% of leaders at financial services firms say they are unprepared to recover effectively from a Ransomware attack.
The Qilin campaign claimed 29 financial organizations headquartered in the Republic of Korea as victims to their DLS in a mid-September Qilin campaign.
The average duration business operations were affected by ransomware in financial services was 33 days.
Between 2019 and 2023, financial services experienced large losses primarily from data breaches (40.9%) and ransomware (40.9%), followed by other causes (18.2%).
The U.S. and U.K. together represent over 70% of ransomware attacks.
The U.S. accounts for 60% of all ransomware attacks against financial institutions.
There were 191 disclosed ransomware victims in the financial sector in 2023.
Nearly one-third (26.6%) of finance threat actors are attributed to "Other", which includes emerging or short-lived groups, highlighting a more fragmented and unpredictable ransomware landscape.
As of mid-2025, only 55 ransomware victims have been disclosed in the financial sector.
There were 156 disclosed ransomware victims in the financial sector in 2024.
The average response time to ransomware attacks is 6.71 hours among financial institutions. Last year's average response time to ransomware attacks was 6.62 hours.
Ransomware remains the greatest threat (46%) to financial organisations.