Ransomware in financial services is costing attackers less money and costing victims more time, according to the 2026 Sophos survey. Sophos asked 177 IT and cybersecurity leaders in banking, financial services and insurance. Every respondent worked at an organization hit by ransomware in the previous 12 months.
What Is the Sophos Survey, and Who Answered?
The State of Ransomware in Financial Services 2026 is the sixth annual report in this series. The respondents came from 17 countries, and the survey ran from January to March 2026. The figures describe organizations that were hit, not the whole sector.
That base matters when you read the numbers. With 177 answers, small gaps between two percentages are weak evidence, and that is our reading, not a Sophos caveat. We quote the larger gaps and the direction of change.
What Does the Survey Say About Ransomware in Financial Services?
Sophos compares the sector with its cross-sector results and with earlier years. The table lists the figures in the Sophos summary, each as the survey gives it. Medians are computed per question, so they need not line up row by row.
| Measure | Financial services 2026 | Comparison given by Sophos |
|---|---|---|
| Median ransom demand | $1 million | $698,000 cross-sector; $3 million in 2025 |
| Demands of $1 million or more | 53% | Not compared |
| Median ransom payment | $1.07 million | $769,000 cross-sector; $2.2 million in 2024 |
| Mean recovery cost, ransom excluded | $1.50 million | $1.74 million last year; $1.70 million cross-sector |
| Median recovery cost | $750,000 | $375,000 overall median |
| Data restored from backups | 75% | 66% cross-sector; 44% last year |
| Attacks that encrypted data | 59% | 56% cross-sector |
| Data encrypted and also stolen | 21% | 18% in 2025; 16% in 2024 |
| Teams more anxious about future attacks | 52% | 11 points above the cross-sector rate |
Sophos adds that the sector took a week longer to recover than in the previous year. The mean recovery cost fell, but the median is double the all-sector median. Sophos reads this as a higher floor and a lower ceiling: fewer cheap recoveries, but no ruinous ones either.
Why Do Falling Ransoms Not Mean Lower Risk?
For a bank or insurer, the survey shows three pressures that do not move together. Payments and demands fell from the prior year, yet both remain above the cross-sector medians. Recovery still takes longer. And one attack in five now combines encryption with theft.
The theft figure is the one to plan around. Sophos says stolen data gives attackers a second source of pressure, which is costly in a heavily regulated sector. In our reading, a restored backup answers the encryption demand but not the notification duties and customer questions that follow a theft. Our entry on double extortion explains the pattern.
Which Entry Points Do Banks and Insurers See Most?
Sophos reports that identity-based vectors started 85% of attacks on financial services, against 79% across sectors. These include malicious email, phishing, compromised credentials and brute force. Malicious email and compromised credentials tied as the leading technical root cause at 26%, with phishing at 23%.
Exploited vulnerabilities fell to 12% from 40% a year earlier. Brute force was a low root cause in every sector, but financial services was the most likely to be breached that way (10%, against 6%).
- IdentityCross-sector rate is 79%Sophos finding85% of attacks began with identity-based vectorsWhere entry happens
- Multi-factor authentication70% of those victims were still encryptedSophos findingEnabled in 96% of credential-based cases
- Network and firewallVictims were encrypted 53% of the time even with early indicatorsSophos findingFlagged 48% of attacks before the ransomware ran
- BackupsUp from 44% last yearSophos finding75% restored data from backups
Sophos concludes that controls collect the right signals but do not connect deeply enough or respond together. It recommends a defense system posture in which identity, email, endpoint and network controls act as one.
What Should Banks and Insurers Take From the Numbers?
Sophos reports that 44% of financial services victims blamed a known security gap, a weakness they knew about and had not fixed. That is the highest rate of any sector and eight points above the cross-sector 36%. Unknown gaps followed at 41%, and lack of protection at 40%. The steps below are our reading of the survey, not Sophos instructions.
- Close the gaps you already know aboutTake your open risk register and rank items by what an identity-based attack could reach. The 44% figure says known and unfixed weaknesses are a main cause.
- Test identity controls against real attacksMFA was on in 96% of credential-based cases, yet 70% were encrypted. Review session lifetime, token theft and helpdesk reset steps, not only whether MFA is enabled.
- Plan for theft as well as encryptionPrepare regulator, customer and partner notices before an incident. Prepare the notices your regulators require.
- Time a full restoreRecovery took a week longer than last year, even though 75% used backups. Measure how long your critical services take to come back, not only whether the backup exists.
- Make alerts trigger actionConnect identity, email, endpoint and network alerts so one signal contains the others.
Our overview of DORA covers the EU duties for financial entities, and our ransomware response checklist gives a starting plan. For the wider threat picture against banks, see our article on how cybercriminals attack financial firms, and our page on the insurance sector. Sophos offers the full report, with sector comparisons and negotiation data, as a free download.