How Does Ransomware Affect Your Business

The last time this article was written, GandCrab was the ransomware strain making headlines, ransoms ran from a few hundred dollars to a few hundred thousand, and the average data breach cost $3.86 million. All three of those facts are now badly out of date. GandCrab shut down its own operation in 2019. Today’s dominant ransomware groups, Qilin, Akira, and RansomHub among them, run polished, professionalized operations with customer support portals for their victims. Average ransom demands crossed $1.16 million in 2025, more than double the year before. And in the first quarter of 2026 alone, ransomware attacks rose 126 percent year over year, the steepest single quarter spike ever recorded.

The mechanics of how ransomware affects a business have not changed much since 2018. Files get encrypted. A ransom gets demanded. Operations stop. What has changed almost completely is the scale, the speed, and the number of separate ways a single attack now damages a business at once. This article walks through exactly how ransomware affects a business in 2026, using current data rather than the 2018 statistics still circulating on most cybersecurity blogs, and what actually works to prevent it.

What ransomware actually is, updated for 2026

Ransomware is malicious software that encrypts a business’s files, denying access until a ransom is paid for the decryption key. That core mechanic has not changed. What has changed is almost everything around it. Most ransomware today is deployed through a Ransomware as a Service model, where the group that writes the malware licenses it to affiliates who actually carry out the attacks, splitting the profits. This is why ransomware operations now run with the structure of a business: recruitment programs for affiliates, technical support for victims trying to figure out how to pay, and increasingly professional negotiation tactics designed to maximize the payout.

Double extortion is now standard practice, not an occasional escalation. Attackers do not just encrypt a business’s files. They exfiltrate a copy first, then threaten to publish or sell the stolen data even if the business restores from backup and never pays for the decryption key. This single shift is why “we have backups” stopped being sufficient protection against ransomware years ago. A business can restore its systems perfectly and still face the separate threat of its stolen client data appearing for sale or being leaked publicly.

The financial impact, current numbers

The 2018 figure of $3.86 million for an average data breach has aged badly. IBM’s most recent Cost of a Data Breach research puts the global average at $4.44 million, with meaningful variation by industry: $5.08 million for law firms specifically, and $7.42 million for healthcare organizations, the highest of any sector tracked. Manufacturing downtime alone now costs an average of $1.9 million per day when a ransomware attack takes production offline, and the average outage now runs 11.6 days.

The ransom itself is frequently the smallest line item in the total cost. Forensic investigation typically runs $80,000 to $400,000. Breach counsel adds another $50,000 to $300,000. Notification costs for affected clients or patients run $2 to $8 per record, with credit monitoring adding another $10 to $50 per person for two years. Add the cost of rebuilding infrastructure, the revenue lost during downtime, and the client attrition that follows a publicized breach, and the ransom demand itself is often a small fraction of the total damage.

The operational impact: downtime that compounds

The most immediate way ransomware affects a business is the simplest to understand and the hardest to absorb: everything stops. Files are inaccessible. Applications that depend on encrypted databases stop functioning. Depending on what got encrypted, this can mean an inability to process orders, bill clients, access patient or client records, or run the systems a manufacturing floor depends on to receive job instructions.

The average small business now experiences a cyberattack roughly every seven seconds somewhere in the country, and once an attack succeeds, the median time from initial compromise to full encryption has dropped to just four days, sometimes far less. Some documented 2026 incidents have gone from initial network access to full compromise in under a minute, using automated tooling that requires no meaningful human involvement on the attacker’s side once the initial foothold is established. The window a business has to detect and stop an intrusion before encryption begins has never been shorter.

The legal and regulatory impact

This is the dimension of ransomware damage that received almost no attention in older coverage of the topic, and it has become one of the most expensive parts of a modern incident. A ransomware attack that exposes client, patient, or employee data triggers separate legal obligations depending on the industry and the state. California businesses face notification requirements under Civil Code Section 1798.82, with the California Attorney General requiring notice for larger breaches. Healthcare organizations face HIPAA obligations with penalties running as high as $2.13 million per violation category per year. Law firms face California State Bar ethical obligations around client confidentiality that exist independently of whatever the firm’s cyber insurance covers. Defense contractors face potential False Claims Act exposure if their cybersecurity attestations to the government do not match what an actual assessment finds after an incident.

None of these obligations disappear because a business paid the ransom and restored its systems. The regulatory and legal exposure runs on its own timeline, frequently for months or years after the operational disruption itself is resolved.

The reputational impact: harder to recover than the data

Client and patient trust, once damaged by a publicized breach, does not restore as cleanly as encrypted files do. Industry surveys consistently show a meaningful share of clients say they would leave a business entirely after learning it suffered a breach, and in sectors like healthcare and legal services, where the relationship depends on confidentiality, that attrition can be severe enough on its own to threaten the business’s viability, entirely separate from the direct financial cost of the incident.

How to actually protect your business in 2026

The foundational advice from the older version of this guide, back up your data, patch your systems, train your employees, deploy real endpoint protection, is still correct. What has changed is what each of those items actually requires to be effective against the current generation of attacks.

• Immutable, tested backups, not just backups. Because double extortion means encrypted backups no longer guarantee recovery, and because attackers now specifically target backup infrastructure before triggering encryption, backups need to be isolated from the production network, immutable, and tested through actual restoration, not just confirmed to exist. See the difference between backup and real disaster recovery, which is exactly the gap that turns a contained ransomware event into a business ending one.
• Patch and update continuously, with priority on internet facing systems. VPN appliances, firewalls, and remote access tools remain the most common entry points, and the exploit window between a vulnerability’s disclosure and active exploitation has shrunk considerably since 2018.
• Multi factor authentication enforced everywhere, no exceptions. Compromised credentials remain the dominant way attackers gain initial access, and MFA closes the largest share of realistic entry paths available to an attacker.
• Real endpoint detection and response, monitored 24/7 by an actual person. Antivirus alone cannot detect the fileless, behavior based techniques modern ransomware relies on. Network segmentation limiting how far an attacker can move even after gaining a foothold is equally critical, since EDR agents themselves are now a deliberate target for disablement.
• Employee awareness that reflects current attack sophistication. AI generated phishing emails are now considerably more convincing than the malspam campaigns this article originally warned about, and training needs to reflect that shift rather than assume attacks still look the way they did several years ago.
• A written, tested incident response plan. Given how fast modern ransomware moves from initial access to full encryption, the first hour of response needs to be executed from a rehearsed plan, not improvised. See what incident response actually looks like when it is done right.

If you are already a victim

The core guidance here has not changed since 2022, and it remains correct. Check whether a free decryptor exists for the specific ransomware variant involved, since law enforcement and security researchers periodically release working decryption tools for older or poorly implemented strains, though this should not be relied upon as a primary recovery strategy. Do not pay the ransom as a first response. The FBI’s position remains that payment does not guarantee file recovery, funds further criminal operations, and, per the current data, still leaves a meaningful share of paying victims without their data anyway. Engage a forensic incident response firm and breach counsel immediately, ideally ones identified before the incident rather than searched for during it, and notify your cyber insurance carrier promptly, since delayed notification is now one of the more common reasons cyber insurance claims get disputed.

The honest version

Ransomware has not changed in its basic premise since the 1980s, when the first documented attacks demanded payment through the mail. What has changed is the professionalization of the criminal groups behind it, the speed at which a single foothold now becomes full compromise, the near universal adoption of double extortion that neutralizes backup only defenses, and the sheer number of separate ways a single incident now damages a business at once. The 2018 statistics and 2018 threat actor names still circulating on many cybersecurity blogs describe a threat landscape that no longer exists.

The prevention fundamentals remain genuinely unchanged: backups, patching, MFA, real endpoint protection, employee awareness, and a tested response plan. What has to change is the seriousness and completeness with which those fundamentals get implemented, because the version of ransomware they were originally built to stop moved much faster and became considerably more damaging than it was when this guidance was first written.

Related reading:
Cybersecurity Services for OC Businesses ·
What Happens to Production When Ransomware Hits a Factory ·
Why Your Backup Is Not Your Disaster Recovery Plan ·
What Does Incident Response Actually Look Like When It’s Done Right? ·
Schedule Your Free Security Assessment