The State of Ransomware in Financial Services 2026

This year’s State of Ransomware survey showed financial services and insurance providers handing over less money to attackers than it did a year ago. Median ransom demands fell by two-thirds and median payments continued a three-year slide.  

The recovery story was less positive. The sector took a week longer to recover than last year, and its typical recovery bill is double the median across all sectors. Financial services was also the most stressed sector: 52% of financial services teams reported increased anxiety about future attacks, the highest rate of any sector and 11 points above the cross-sector rate. 

The sixth annual Sophos State of Ransomware in Financial Services report is now available, with findings from 177 IT and cybersecurity leaders in banking, financial services, and insurance whose organizations were hit by ransomware in the last 12 months. The survey was administered from January to March 2026. 

Click here to access the full report now.

Attack vectors concentrated on identity

Identity-based vectors, including malicious email, phishing, compromised credentials, and brute force, initiated 85% of attacks against financial services. This was one of the highest rates for any sector and well above the 79% cross-sector rate for identity-based initial vectors.

Malicious email and compromised credentials tied as the leading technical root cause at 26%, with phishing close behind at 23%. Exploited vulnerabilities dropped to 12%, down from 40% last year.

While brute-force attacks were a low occurrence root cause across all sectors, financial services was the most likely sector to be breached by a brute force attack (10%, versus 6% across all sectors).

The sector was breached through gaps it already knew about

44% of financial services victims attributed their breach to a known security gap, a weakness they were aware of but had not addressed. That was the highest rate of any sector and eight points above the 36% cross-sector rate for known security gaps.

Unknown gaps were close behind at 41%, and combining the two, roughly 69% cited a security gap of some kind. Lack of protection followed at 40%. The report compares each operational root cause with the cross-sector average.

Double extortion keeps climbing

59% of attacks on financial services providers succeeded in encrypting data, close to the 56% cross-sector rate and unchanged from last year. What shifted was the mix: attacks that encrypted data and also stole it rose to 21%, up from 18% in 2025 and 16% in 2024. That second point of leverage is costly in a heavily regulated sector.

Luckily, financial services were better prepared for recovery with 75% restoring data from backups, which was better than the 66% cross-sector rate and a sharp rebound from only 44% using backups last year.

A higher floor on ransoms, but deeper discounts

Financial services faced steeper demands: a median of $1 million versus the $698,000 cross-sector median, and 53% of demands were for $1 million or more. Payments were also high, with a median of $1.07 million against the $769,000 cross-sector median.

Both of those medians, however, were lower than last year’s medians. The median demand fell from $3 million in 2025, and the median payment continued a two-year decline from $2.2 million in 2024.

The report covers how well the financial services was able to negotiate ransomware payments.

Costs eased, but recovery did not

The average (mean) recovery cost, excluding any ransom paid, was $1.50 million, down from $1.74 million last year and below the $1.70 million cross-sector average.

The median tells a different story at $750,000, double the $375,000 overall median. The sector has a higher floor and a lower ceiling: fewer cheap recoveries, but no ruinous ones either. You can find out how long post-ransomware attack recovery timelines were for the financial services sector in the full report.

Defenses saw the attack, but did not stop it

Almost all financial services victims of credential-based attacks had MFA enabled (96%), yet 70% were still encrypted. Firewalls flagged 48% of attacks before the ransomware deployed, but even with early indicators, victims were encrypted 53% of the time. 

Controls are collecting the right signals but they’re not connecting deeply enough with other tools and responding together. The report contains several key recommendations based on this year’s data, and one of those recommendations is to adopt a defense system posture where identity, email, endpoint, and network controls respond as one.

Read the report

The financial services sector is paying attackers less and recovering from backups more, but it is recovering slower and carrying a heavier human cost than almost any other sector. Closing known gaps and connecting existing defenses is the highest-leverage place to invest.

Download the free report for the full findings, sector comparisons, and recommendations.