Shaun Stockman is Senior Director of Business Development, Americas at Ontrack, where he works with insurance carriers and incident response teams on the data recovery side of ransomware claims.
I get asked this question about once a week now, usually by someone on the insurance or DFIR side who already knows the ransom figure and wants the real one. The real number in 2026 is close to $1.7 million just to recover, according to Sophos, and that's before anyone adds a ransom payment or the revenue lost while systems are down. I've watched that recovery figure climb for three years straight, even as ransom demands themselves have started to shrink. That gap, between what attackers ask for and what recovery actually costs, is the real story.
Key takeaways
- Average ransomware recovery cost hit $1.7 million in 2026, up 11% from the prior year, per Sophos. That figure excludes any ransom paid.
- Median ransom payments have dropped, in some reports to around $150,000, but rebuild and downtime costs haven't followed the same curve.
- Downtime is still the biggest line item. Manufacturers lose an estimated $1.9 million per day during an outage. Healthcare organizations lose around $900,000 per day.
- Ransomware accounts for 28% of cyber insurance claims but 52% of total claims costs, and insurers denied or partially denied 21% of claims in 2025.
What does recovery actually cost in 2026?
Sophos put the average recovery cost, meaning everything spent to get systems and data back that isn't the ransom itself, at $1.7 million in its 2026 report. That's up 11% from $1.53 million the year before. IBM's Cost of a Data Breach Report puts the full cost of an average ransomware incident, including legal exposure, remediation, and business interruption, at $5.08 million.
I think the more useful number for insurance and IR folks is the gap between those two figures and the ransom itself. The median ransom payment landed around $769,000 in the Sophos data. Recovery cost alone is already more than double that. Paying the ransom was never really the expensive part; rebuilding is. If you want a walkthrough of what that rebuild process actually looks like on the ground, we've written about recovering data from ransomware attacks in more detail.
Why are ransom payments falling while recovery costs keep rising?
This is the part that surprised me a little. Coveware's data shows the share of victims choosing to pay has hit a record low, and median payments have fallen sharply, in one recent quarter down to around $150,000. At the same time, 56% of attacks still succeed in encrypting data, up from 50% the year before. More attacks are getting through, and fewer companies are paying to unlock what got encrypted.
That combination is exactly why recovery cost is climbing on its own track. Whether or not a company pays, someone still has to rebuild the environment, restore from backup where possible, and recover what backup couldn't reach. Paying doesn't even guarantee a clean outcome. Companies that pay recover, on average, only around 60% of their data. I guess that's the part worth repeating to anyone still treating the ransom decision as the main cost center. It isn't. We covered the actual decision tree on this in ransomware, should we pay the ransom, which is worth reading before that decision has to get made under pressure.
I've also noticed the ransom number and the recovery number get treated as one line item in a lot of internal reports I see. They aren't. A carrier or IR firm that budgets for the ransom and treats recovery as a rounding error is going to miss the real exposure by a wide margin. The recovery bill shows up whether or not the ransom gets paid, and lately it's the bigger of the two by a comfortable margin.
Where does the money actually go: downtime
If I had to point to one line item that insurance underwriters underestimate, it's downtime. Manufacturers face an estimated $1.9 million per day in losses while systems are down. Healthcare organizations are looking at roughly $900,000 per day. Average downtime across a ransomware incident runs somewhere between 21 and 24 days, though that's improving. Sophos found 53% of organizations fully recovered within a week in 2025, up from 35% the year before.
That improvement comes from better preparation and faster engagement with recovery specialists once an attack is confirmed, not from paying ransoms faster. The companies dragging out 20-plus days of downtime are usually the ones deciding what to do after the attack instead of before it. We laid out what that early decision-making should look like in dealing with a ransomware attack, and I still think the first 48 hours matter more than almost anything else in the timeline.
How is this showing up in cyber insurance?
Ransomware made up 28% of all cyber insurance claims in 2025 but 52% of total claims costs. Average ransomware claims run around $631,000, making it the costliest attack category by a wide margin. Severity has climbed more than 30% since 2020, driven by extortion demands, business interruption, and breach response costs stacking on top of each other.
The part I'd flag for anyone on the insurance side is the denial rate. About 21% of cyber claims were denied or partially denied in 2025, up from 15% in 2023. The single most common reason was failure to maintain the security controls stated in the policy, things like MFA and documented incident response plans. Not totally sure that number will hold steady, but the direction is clear. Insurers are underwriting harder and checking claims against stated controls more closely than they used to.
What this means for your next incident
Two things I'd tell any IT lead, insurance contact, or DFIR partner reading this. First, don't let the ransom decision hold up the recovery decision. Bring in a data recovery specialist in parallel with the ransom negotiation, not after it. The rebuild clock and the negotiation clock should run at the same time, because downtime is costing more per day than most ransom demands cost per incident. Second, if you're on the insurance side, get ahead of the control requirements before renewal. A denied claim on top of a $1.7 million recovery bill is one of the most preventable problems in this whole process.
I'd also add a smaller point that gets missed. Recovery specialists brought in early can often shrink both numbers at once, less downtime because systems come back faster, and a cleaner claims file because the recovery effort is documented from day one instead of reconstructed after the fact. That documentation matters more than people expect once an insurer starts checking a claim against the policy's stated controls.
FAQ
Is it cheaper to pay the ransom than to recover on your own?
No, not in most cases. Paying doesn't remove rebuild costs, and companies that pay recover only around 60% of their data on average. The ransom is often smaller than the recovery bill that follows.
How long does full recovery take in 2026?
Average downtime still runs 21 to 24 days, but more organizations are recovering faster. Sophos found 53% fully recovered within a week in 2025, up from 35% a year earlier.
Why do insurers deny ransomware claims?
The most common reason is failure to maintain the security controls stated in the policy, most often MFA and documented incident response planning. That accounted for roughly a third of all denials in 2025.
What's the single biggest cost driver in a ransomware attack?
Downtime. Manufacturers lose an estimated $1.9 million per day and healthcare organizations around $900,000 per day while systems are down, and that adds up faster than most ransom demands.
Where this leaves us
Recovery cost is the number that keeps climbing, and I don't think that trend reverses anytime soon. The ransom conversation gets most of the attention, but the rebuild is where the real bill shows up. I'd rather see insurance teams and IR partners plan around that number now than get surprised by it during the next incident.
Sources: Sophos, The State of Ransomware 2026; IBM, Cost of a Data Breach Report; Coveware by Veeam, Cyber Extortion Payment Trends
United States | English
Locations
Search
Back to listing
