Ransomware in 2026 how attacks work and how organisations recover

[BigDog10]

TL;DR

• Ransomware attacks now usually combine data theft with encryption, then extort victims twice: pay to unlock systems and pay to stop a leak
• Chainalysis estimated about US$820 million in ransomware payments in 2025, around 8 percent lower than 2024, even as publicly claimed victims rose by roughly half, with the share of victims paying at a record low
• The UK NCSC's 2026 Annual Review recorded 1,831 reports of attacks and 80 nationally significant incidents between September 2025 and August 2026, down from 204 a year earlier
• High profile 2025 attacks on Marks and Spencer, Co-op and Jaguar Land Rover showed how social engineering and supply chains can halt major businesses for weeks
• Recovery depends on preparation: tested offline or immutable backups, an incident response plan, rehearsals and clear decisions about payment made in advance
• Prevention focuses on patching internet facing systems, phishing resistant MFA, hardened help desk processes, least privilege and good monitoring

Why ransomware still dominates

Ransomware has been the most disruptive form of cybercrime for most of the past decade, and 2026 has been no exception. It affects hospitals, schools, councils, manufacturers, retailers and small businesses alike. Attacks can stop production lines, empty supermarket shelves and delay medical treatment. The human and economic costs are enormous

The business model explains its persistence. Ransomware as a service operations develop malware and infrastructure, then recruit affiliates who carry out intrusions in exchange for a share of ransoms. Initial access brokers sell entry into compromised networks. This division of labour lets relatively unskilled criminals launch damaging attacks, and it makes the ecosystem resilient even when individual groups are disrupted

This thread explains how modern ransomware attacks unfold, summarises recent data and incidents, and sets out practical steps for prevention and recovery. It aims to be useful for leaders, IT teams and anyone trying to understand the headlines. The figures come from named sources so they can be checked and cited. The overall message is constructive, because preparation makes a decisive difference

How a typical attack unfolds

Most attacks begin with initial access. Common routes include exploiting vulnerabilities in internet facing systems such as VPN appliances and file transfer servers, logging in with stolen or guessed credentials, phishing emails and social engineering of help desks to reset passwords or multi factor authentication. The NCSC's 2026 review highlighted exploitation of known vulnerabilities, stolen credentials and social engineering as the most common successful methods. Many of these are preventable with good hygiene

Once inside, attackers move laterally and escalate privileges. They map the network, harvest credentials, disable security tools and seek administrator access to directory services and virtualisation platforms. This phase can last days or weeks. Detecting it is the best chance to stop an attack before encryption

Data theft usually comes next. Attackers copy sensitive files to their own servers so they can threaten to publish them, a tactic called double extortion. Some groups skip encryption entirely and rely on data theft alone. Leak sites list victims who refuse to pay

Finally, attackers deploy encryption, often targeting virtual machine hosts so that many servers are locked at once, and try to destroy or encrypt backups. A ransom note demands payment in cryptocurrency, sometimes with deadlines and threats. By this point, the damage is done. Recovery begins

What the data says

Blockchain analysis firm Chainalysis estimated in February 2026 that ransomware payments in 2025 totalled about US$820 million, around 8 percent less than in 2024 and the second consecutive annual decline. Over the same period, publicly claimed victims on leak sites rose by roughly 50 percent, with Emsisoft counting more than 8,000 organisations named. The share of victims paying fell to a record low of around 28 percent. More attacks but fewer payments suggests that improved resilience and refusal to pay are having an effect, while criminals compensate with volume

In the UK, the NCSC's Annual Review 2026, published on 3 November 2026, reported 1,831 reports of cyber attacks on UK organisations between September 2025 and August 2026. Of 337 incidents requiring NCSC support, 80 were classed as nationally significant, down from 204 the previous year. The NCSC also sent around 8,500 early warning notifications to organisations about possible compromises. Year to year comparisons depend on reporting and classification, so trends should be read carefully

Costs remain high. IBM's 2026 Cost of a Data Breach report put the global average breach cost at US$4.99 million, with ransomware and extortion incidents typically among the more expensive. Downtime, recovery, legal costs and lost business often dwarf any ransom. That is why prevention and recovery planning offer such strong returns

Lessons from recent incidents

In April 2025, Marks and Spencer suffered a cyber attack that halted online orders for weeks and affected stores, with the company later estimating a hit to operating profit of around 300 million pounds. The Co-op and Harrods also reported attacks in the same period. Reporting and statements linked the incidents to a loose cybercrime collective known as Scattered Spider, which specialises in social engineering of IT help desks, with DragonForce ransomware involved in some cases. The episode showed how a convincing phone call to a help desk can open the door to a major breach

In September 2025, Jaguar Land Rover shut down its production systems after a cyber attack, halting manufacturing for around five weeks and disrupting its supply chain. The UK government provided a loan guarantee of up to 1.5 billion pounds to support the company and its suppliers, and the Cyber Monitoring Centre estimated the economic impact on the UK at around 1.9 billion pounds. The incident highlighted the cascading effects on small suppliers who depend on a single large customer. Business continuity planning across supply chains is now a board level concern

Healthcare remains a frequent target. The February 2024 attack on Change Healthcare in the US disrupted pharmacy and payment systems nationwide, led to a reported US$22 million ransom payment and affected the data of around 190 million people. Payment did not prevent data exposure. It remains one of the clearest examples of why paying offers no guarantees

Law enforcement has had successes too. In February 2024, an international operation led by the UK's National Crime Agency, called Operation Cronos, disrupted the LockBit ransomware group, seizing infrastructure and decryption keys. Other operations have taken down leak sites and arrested affiliates. These efforts raise costs for criminals, although new groups quickly fill gaps

To pay or not to pay

Whether to pay a ransom is one of the hardest decisions an organisation can face. Payment may restore systems faster, but there is no guarantee that decryption tools will work, that stolen data will be deleted or that attackers will not return. Payments fund further crime and may breach sanctions if the recipients are designated entities. Authorities including the NCSC, the FBI and CISA advise against paying

Policy is moving in this direction. In July 2025, the UK government announced plans to ban ransom payments by public sector bodies and operators of critical national infrastructure, alongside a regime requiring other organisations to notify the government before paying and mandatory incident reporting. As of early 2026, the detailed legislation was still being developed. Organisations should decide their stance on payment in advance, with legal and board input, rather than in the middle of a crisis

Prevention: closing the common doors

Patch internet facing systems quickly. VPN appliances, firewalls, remote access tools and file transfer servers are prime targets, and attackers often exploit new vulnerabilities within days of disclosure. Maintain an inventory of these systems and prioritise their updates. Retire devices that no longer receive security fixes

Strengthen identity. Use phishing resistant multi factor authentication, such as passkeys or hardware security keys, especially for administrators and remote access. Harden help desk processes so that password and MFA resets require strong identity verification, such as video calls with known colleagues or in person checks for privileged accounts. The 2025 retail attacks showed that social engineering of help desks can bypass technical controls

Limit privileges and segment networks. Remove standing administrator rights, protect directory services and backup systems with separate credentials, and segment critical systems so attackers cannot move freely. Monitor for unusual activity such as mass file access, new administrator accounts or disabled security tools. Endpoint detection and response tools and managed detection services help smaller organisations without large security teams

Recovery: preparing for the worst

Backups are the foundation of recovery. Follow the widely used 3-2-1 approach: at least three copies of data, on two different types of storage, with one copy offline or immutable so attackers cannot encrypt or delete it. Protect backup systems with separate credentials and multi factor authentication. Most importantly, test restoring from backups regularly, including restoring whole systems, not just individual files

Have an incident response plan that covers technical steps, communications, legal obligations and decision making. Know who to call, including incident response firms, insurers, legal advisers and authorities such as the NCSC or Action Fraud in the UK and the FBI in the US. Keep printed or offline copies of the plan and contact lists, since attacks may disable email and file systems. Plans that live only on the network are useless when the network is down

Rehearse. Tabletop exercises that walk leaders and staff through a realistic ransomware scenario reveal gaps in plans, decision rights and communications. The NCSC's Exercise in a Box tool offers free exercises for UK organisations. Organisations that rehearse recover faster and make better decisions under pressure

Plan for business continuity. Identify the processes that matter most, such as taking orders, paying staff or treating patients, and work out manual or alternative ways to run them for days or weeks. Coordinate with key suppliers and customers. The Jaguar Land Rover incident showed how continuity planning must extend across supply chains

Check for free decryptors before considering payment. The No More Ransom project, launched in 2016 by Europol, the Dutch police and security companies, offers decryption tools for many ransomware families. Law enforcement sometimes recovers keys during operations, as with LockBit. A quick check can occasionally avoid a painful decision

A ransomware readiness checklist

• Patch internet facing systems promptly and retire unsupported devices
• Enforce phishing resistant MFA, especially for admins and remote access
• Harden help desk identity verification for password and MFA resets
• Remove standing admin rights and segment critical systems
• Monitor for lateral movement, privilege changes and mass data access
• Keep offline or immutable backups and test full restores regularly
• Maintain an offline incident response plan and contact list
• Run tabletop exercises with leadership at least annually
• Decide your position on ransom payment in advance with legal and board input
• Plan business continuity with key suppliers and customers

Closing thoughts

Ransomware remains a serious threat in 2026, but the picture is not hopeless. Falling payment rates, law enforcement disruption and growing resilience show that preparation works. Most attacks still exploit preventable weaknesses such as unpatched systems, weak identity controls and untested backups. Organisations that address these fundamentals and rehearse their response dramatically reduce both the likelihood and the impact of an attack

Please share lessons from ransomware exercises or real incidents in the replies, with sensitive details removed. Practical advice for small organisations without dedicated security teams would be especially valuable. Learning from each other is one of the best defences we have


Key references for citation

• Chainalysis, ransomware payments analysis for 2025, February 2026
• UK NCSC, Annual Review 2026, November 2026
• IBM, Cost of a Data Breach Report 2026
• UK Home Office, response to the ransomware legislative proposals consultation, July 2025
• Cyber Monitoring Centre, assessment of the Jaguar Land Rover incident, 2025
• UK National Crime Agency, Operation Cronos against LockBit, February 2024
• No More Ransom project (nomoreransom.org)

[MJF86]

Tested restores are where most organisations fall down. We had backups for years and assumed they worked. Nobody had ever restored more than a single file. That should have been a warning

During a tabletop exercise, we tried restoring a whole file server and discovered it would take nine days. Leadership was shocked. We redesigned our backup approach and got it under one day. That exercise was the most valuable two hours we spent all year. Faster storage and better runbooks did most of it

Do the restore test. Do not just check that backup jobs succeed. Green ticks can lie