Ransomware Costs in 2025: Corporate and SMB Impact

Ransomware is expensive before anyone decides whether to pay. An intrusion can stop orders, claims, bookings, shipping, payroll, or customer support. Investigators must determine whether the attacker still has access. At the same time, other teams rebuild services and manage legal, insurance, regulatory, and customer duties.

Three figures help frame the ransomware economy in 2025. The FBI received 3,611 ransomware complaints with $32.3 million in reported adjusted losses. It recorded another $122.5 million under the broader category of extortion.

Chainalysis estimated more than $820 million in global, on-chain ransomware payments. These figures measure different groups and must not be added together. Each shows a different part of the cost.

The consequences differ by organization. A large enterprise may spread disruption across subsidiaries, suppliers, shared applications, and millions of records. A small or medium-sized business has fewer systems, but a long outage can threaten payroll, credit, and survival. Size changes the mechanics of the crisis, not its seriousness.

Ransomware losses reported for 2025

The FBI Internet Crime Report 2025 lists 3,611 ransomware complaints and $32,320,105 in adjusted losses. Its separate extortion category lists 89,129 complaints and $122,499,133 in losses. One complaint receives only one crime type. Extortion also includes conduct unrelated to ransomware, so the categories are not a complete ransomware total.

The FBI also explains why its ransomware number looks low compared with major incidents. Adjusted loss normally excludes lost business, staff time, wages, files, equipment, and third-party remediation. Some organizations provide no loss amount. Cases reported directly to FBI field offices are also outside the IC3 figure.

Chainalysis uses a different method: it follows cryptocurrency transactions attributed to ransomware. The company estimated more than $820 million in on-chain payments during 2025. That was about 8% below its revised 2024 estimate of $892 million. At the same time, claimed victims listed by ransomware groups increased 50% year over year.

Fewer observable dollars did not mean fewer attacks.

The Verizon 2026 Data Breach Investigations Report analyzes incidents from November 2024 through October 2025. It found ransomware in 48% of breaches in its dataset. Verizon also reported that 69% of ransomware victims did not pay. Refusing payment limits criminal revenue, but it does not erase the cost of investigation, restoration, interruption, notification, or litigation.

The chart preserves each source's scope:

• $32.3 million: FBI-adjusted losses in U.S. ransomware complaints.
• $122.5 million: FBI-reported losses for the broader U.S. extortion category.
• More than $820 million: Chainalysis estimate of global on-chain ransomware payments.

Complaint data, blockchain analysis, insurance claims, and public-company filings answer different questions. Any credible loss estimate should name its geography, population, time period, and definition of loss.

How double extortion works

Early ransomware campaigns relied mainly on encryption: pay for a decryption key or rebuild without it. Double extortion adds stolen data to the negotiation. Attackers copy information before they encrypt systems, then threaten both continued disruption and publication of the files.

“Double ransom” usually does not mean two invoices. It means two kinds of pressure:

1. Availability: systems stay locked, slowing or stopping normal work.
2. Confidentiality: stolen data may be published, sold, or used for further fraud.

Tested, isolated backups weaken the first threat. They cannot retrieve customer records, employee files, contracts, source code, credentials, or regulated information already in an attacker's possession.

The intrusion may begin with a stolen credential, phishing message, vulnerable internet-facing device, exposed remote service, or compromised supplier. After gaining access, an operator looks for privileged accounts, maps servers, and identifies backups. The operator also searches for material likely to create legal or reputational pressure. Large collections of files may be compressed and transferred before encryption begins.

That timing matters. The ransom note is often a late-stage symptom. The attacker may have spent days or weeks moving through the network before staff see it.

The theft may already be complete. Some groups add more pressure by contacting customers or executives. Others disrupt public services with denial-of-service traffic.

Data leaks can outlast the outage

Ransomware groups use leak sites as negotiating tools. A listing may name the victim, display sample documents, and show a countdown. If talks fail, the group may publish or sell a larger archive. It may also leave the data where other criminals can copy it.

A leak-site post is a criminal claim, not an audit record. Groups can exaggerate theft, recycle old files, or name an organization they did not fully compromise. The reverse is also true: no public listing does not prove that data remained inside the network. Investigators need endpoint evidence, authentication logs, cloud logs, and transfer records to establish what was accessed or removed.

Payment provides no verifiable deletion mechanism. Copies may remain with affiliates, access brokers, hosting providers, or other criminals after a group says the files are gone. Notification duties, contractual claims, litigation, and regulatory review can continue regardless of the payment decision.

Data theft therefore adds costs that backups do not solve. These include forensic scoping, breach counsel, notifications, identity monitoring, call-center support, regulatory submissions, and customer remediation. Restoring servers is only one part of recovery.

Corporate ransomware costs: scale and interdependence

Large organizations often have bigger security teams, along with more identities, endpoints, suppliers, acquisitions, and shared platforms. A failure in one central service can interrupt several business units and hundreds of downstream organizations.

The Change Healthcare incident illustrates that scale. UnitedHealth Group's 2024 results reported $2.223 billion in direct cyberattack response costs. Optum Insight reported another $867 million in business-disruption effects.

Problems with claims and payment processing reached across the U.S. healthcare system. The disruption did not stop at the breached company's offices.

MGM Resorts disclosed a different kind of loss. Its October 2023 SEC filing estimated an approximately $100 million negative effect on Adjusted Property EBITDAR. It also reported less than $10 million in one-time expenses. Disrupted reservation and guest systems translated a network intrusion into lost hospitality revenue.

These cases are not 2025 loss totals; they are public examples of how the bill develops. Direct response spending, business interruption, lost revenue, customer assistance, legal work, and long-tail claims can greatly exceed the demand itself.

SMB ransomware costs: less room for delay

Small and medium-sized businesses often depend on a short list of applications and one technology provider. Only a few people may have administrative access. Backups may exist but remain connected to production or go untested. One administrator account, remote-access gateway, or managed-service provider can become a single point of failure.

The Verizon 2026 Breach Impact Study defines SMBs in its analysis as organizations with revenue under $25 million. In the most severe 2.5% of SMB claims, losses exceeded 7% of annual revenue. A large company may borrow, redirect staff, or absorb a long recovery. A smaller firm with thin cash reserves has far less time.

KNP Logistics Group is a stark example. A UK government ransomware assessment records that the company blamed a 2023 ransomware attack for its insolvency. More than 700 jobs were lost.

The decisive cost was not simply the demand or the recovery invoice. It was the end of the business.

For an SMB, a realistic cost model should include lost sales, idle labor, and emergency consulting. It should also cover replacement systems, restored identities, legal advice, customer communications, insurance deductibles, and higher premiums. Leaders should ask how long critical work can continue without normal digital services.

APT is not another name for ransomware

APT stands for advanced persistent threat. The NIST definition describes a sophisticated and well-resourced adversary. It uses several attack methods, keeps access over time, and adapts to defenders while pursuing strategic goals.

Most ransomware operations are profit-driven criminal businesses, even when their tools are advanced and their dwell time is long. State-linked APT groups more often pursue intelligence, strategic access, disruption, or destruction. Their techniques can overlap with ransomware crews, but their motives and missions differ.

NotPetya shows why the distinction matters. In 2017, destructive malware attributed by the U.S. Department of Justice to officers of Russia's GRU displayed a ransomware screen. The Justice Department said it caused nearly $1 billion in losses to three named victims alone.

Payment could not produce a realistic recovery. Destruction, not extortion, was the operation's purpose.

The lesson for businesses is practical: do not infer an attacker's objective from the ransom note. Incident responders must determine what happened and what remains accessible. They must also find out what data left the environment and whether the activity could continue after restoration.

Recovery time drives the final cost

The ransom demand is visible, but recovery time determines much of the final bill. Costs include lost sales, idle labor, forensic support, legal review, and rebuilt identity systems. Replacement equipment, regulatory work, customer assistance, and insurance changes add more. Data exposure may create new expenses after systems return.

A useful plan asks how long the organization can perform critical work without normal digital services. It also asks how confidently services can be restored without trusting an attacker.

That answer exposes weak recovery assumptions before an incident does. It also gives leaders a better basis for funding backups, segmentation, identity protection, logging, supplier controls, and rehearsed response procedures.

Frequently asked questions

Is paying a ransomware demand illegal?

Payment is not universally illegal, but sanctions, anti-money-laundering rules, and local law may make a particular transaction unlawful. Qualified legal counsel, law enforcement, and the insurer should be involved before a decision. Payment does not guarantee decryption or deletion of stolen data.

Are backups enough to defeat double extortion?

Isolated, protected, and regularly tested backups reduce the attacker's encryption pressure. They do not reverse data theft. A double-extortion incident requires both operational recovery and a data-breach response.

Why do ransomware estimates vary so widely?

Each source measures a different group. Complaint portals record victim-reported losses, while blockchain analysts estimate payments. Insurers examine claims, surveys estimate recovery expenses, and public companies disclose effects they consider material to investors.

Next: how to prevent ransomware

The follow-up article, Before the Lockout, will turn these losses into a practical prevention plan for corporations and SMBs. It will cover phishing-resistant multifactor authentication, patching exposed systems, network segmentation, immutable backups, supplier controls, monitoring, and first-day incident actions.

Sources

FBI Internet Crime Report 2025 and Chainalysis: Crypto Ransomware in 2025 provide the complaint and payment figures.

Verizon's 2026 Data Breach Investigations Report and 2026 Breach Impact Study provide the breach, payment, and SMB claim findings.

UnitedHealth Group's 2024 results and MGM Resorts' October 2023 SEC filing support the corporate examples.

The UK government ransomware options assessment supports the KNP Logistics example.

The NIST APT glossary and U.S. Department of Justice NotPetya case support the APT distinction.

Need Help Securing Your Infrastructure?

Turn questions about exposed services or access controls into a defined review. Discuss your systems and concerns with FOO.XYZ through our security audits and consulting, with testing limited to agreed targets and authorization.

Phone: (213) 212-8317

Email: hello@foo.xyz

FOO.XYZ serves businesses in Los Angeles. Scope and scheduling are agreed before work begins.