Ransomware surge leaves victims weighing payment options

Nearly half of companies hit by ransomware attacks end up paying the ransom to regain access to their data or systems, according to 2025 research from cybersecurity firm Sophos. The study also found that the median amount demanded by hackers is on the rise, putting victims in an increasingly difficult position.

Businesses of all sizes are affected, but small and medium-sized enterprises are particularly vulnerable. The decision to pay or not carries significant financial and operational consequences, as paying does not guarantee data recovery and may encourage further attacks.

In response to the growing threat, some governments are moving to ban ransom payments. The UK, for instance, is advancing legislation that would prohibit public sector bodies and critical national infrastructure organizations—including the National Health Service, local councils, and schools—from making payouts to hackers.

Ransomware hackers have become more sophisticated over time, carefully targeting their victims and demanding higher sums. The Sophos report highlights the evolving tactics of cybercriminals, who now conduct extensive reconnaissance before launching attacks.

The proposed UK ban reflects a broader debate about whether paying ransoms fuels the ransomware ecosystem. If enacted, it could force affected organizations to rely on backups and incident response plans instead of giving in to demands. The move may also influence other countries considering similar measures to curb the ransomware surge.