Here are 10 key takeaways from this year’s findings:

1. Unknown Security Gaps Still Dominate

Nearly half (46%) of retail ransomware incidents were traced back to previously unknown vulnerabilities, highlighting major visibility and risk assessment challenges within retail IT environments.

2. Known Flaws Remain an Open Door

For the third consecutive year, exploiting known vulnerabilities ranked as the top technical cause of ransomware attacks, proving that patch management remains a weak link for many retailers.

3. Ransom Payments Are Rising

A staggering 58% of retailers with encrypted data admitted to paying the ransom, marking one of the highest payment rates in five years.

4. Ransom Demands Double

The median ransom demand soared to $2 million, doubling from 2024, while the average payment climbed to $1 million, a 5% increase.

5. Encryption Rates Hit a Five-Year Low

There’s a silver lining: only 48% of attacks now result in data encryption, the lowest figure in five years. Retailers are getting better at detecting and stopping attacks midstream.

6. Extortion-Only Attacks Are Rising

Even as encryption declines, extortion-only attacks, where hackers steal and threaten to leak data, have tripled from 2% in 2023 to 6% in 2025.

7. Recovery Costs Are Falling

The average cost of recovery, excluding ransom payments, dropped 40% to $1.65 million, the lowest in three years, a positive sign that incident response and resilience strategies are improving.

8. Limited Expertise Still Hurts Defenses

45% of respondents cited limited in-house cybersecurity expertise as a major weakness, followed closely by gaps in protection coverage (44%). Skills shortage remains a top operational challenge.

9. Human and Leadership Impact is Growing

Beyond financial loss, ransomware is taking a human toll. 47% of IT teams reported increased stress post-attack, and 26% of retailers replaced leadership teams after data encryption incidents.

10. Ransomware Groups Are Expanding Their Reach

Sophos tracked nearly 90 ransomware or extortion groups targeting retailers in the past year, with Akira, Cl0p, Qilin, PLAY, and Lynx among the most active.

The Bottom Line

The Sophos report underscores a critical truth: while retailers are becoming more prepared, attackers are also adapting. Proactive visibility, skilled personnel, and 24/7 threat monitoring are no longer optional, they’re essential.

This year’s report reveals that nearly half (46%) of retail ransomware incidents were traced to an unknown security gap, underscoring ongoing visibility challenges across the retail attack surface.

Among organizations that had data encrypted, 58% paid the ransom to get their data back – the second highest payment rate in five years.

 Key Findings from the report

• 46% of attacks began with an unknown security gap (top operational factor)
• 30% of attacks exploited known vulnerabilities (top technical root cause, third year running)
• 58% of victims with encrypted data paid; 48% of attacks resulted in encryption (five-year low)
• Median ransom demand doubled to $2 million from 2024; average payment increased 5% to $1 million

What Sophos is Seeing in Retail

In the past year, the Sophos X-Ops has observed nearly 90 distinct threat groups target one or more retailers with ransomware or extortion across leak sites.

The most active groups Sophos has tracked from incident response and MDR cases are Akira, Cl0p, Qilin, PLAY, and Lynx.

After ransomware, account compromise was the second most common incident type seen against retailers.

And like many industries, retail is a consistent target of business email compromise (BEC) groups seeking to divert payments, which is the third most common incident type.

“Retailers globally are facing a more complex threat landscape where adversaries are constantly on the lookout for and exploiting existing vulnerabilities, most frequently in remote access and internet facing networking equipment. Now, with ransom demands reaching new highs, the need to implement comprehensive security strategies is even more apparent. Without this, retailers risk ongoing operational disruption and lasting reputational damage that could take years to repair. Encouragingly, many are beginning to recognize this and respond by investing in their cyber defenses, enabling them to stop attacks before they escalate and recover faster,” says Chester Wisniewski, director, global field CISO, Sophos.

Limited in-house expertise was the second-most common operational driver of compromise (45%), followed by gaps in protection coverage (44%). Without the right skills and coverage, retailers struggle to detect and neutralize attacks.

Alongside these challenges, there are also signs of progress. The percentage of attacks stopped before encryption reached a five-year high, indicating that retail organizations are improving their ability to detect and neutralize attacks swiftly.

The data encryption rate is at its lowest level in five years, with only 48% of attacks now resulting in data encryption.

While the average retail ransom payment has risen by 5% ($1m in 2025, up from $950k in 2024), the average ransom payment is half the average ransom demand, suggesting that retail organizations are becoming more resistant to inflated ransom demands and are potentially seeking expert advice to navigate ransomware attacks.

“In the end, successful security programs are focused on risk management. To assess and manage those risks, retailers must have visibility into the threats they face as well as their assets and their security posture. Organizations that combine strong asset management and patching with Managed Detection and Response services and managed risk services prevent more and recover faster, taking a proactive approach in their cyber defenses.”

According to the State of Ransomware in Retail report 2025

• Data encryption is falling, but adversaries are adapting: Although data encryption rates were at their lowest level in five years, adversaries are adapting as the proportion of retailers hit by extortion-only attacks has tripled, rising from 2% in 2023 to 6% in 2025.

• Backup rates are falling: 62% of retailers who experienced attacks restored their data using backups, the lowest rate in four years.

• Retailers are resisting ransom demands: Looking closely at demands vs. payments, only 29% of retailers said their payment matched the initial demand. 59% paid less than the initial ask, while 11% paid more.

• Recovery costs are on the decline: Encouragingly, the average (mean) cost of recovering from a ransomware attack, excluding any ransom payment, has dropped by 40% over the past year to $1.65M, its lowest point in three years.

• Ransomware attacks directly impacted teams: Almost half (47%) of retail IT/cybersecurity teams reported increased pressure after experiencing data encryption, while one quarter of cases (26%) saw leadership teams replaced as a result.

Strengthening Defenses for the Long Term

Based on its experience protecting retail organizations worldwide, Sophos recommends the following best practices to help businesses stay ahead of ransomware and other cyberthreats:

• Eliminate Root Causes: Take proactive steps to address common technical and operational weaknesses, such as exploited vulnerabilities, that adversaries frequently target. Solutions like Sophos Managed Risk can help organizations assess their exposure and reduce risk across their environments.
• Defend Every Endpoint: Ensure all endpoints, including servers, are protected with dedicated anti-ransomware defenses to prevent attacks from gaining a foothold.
• Plan and Prepare: Establish and routinely test a comprehensive incident response plan. Maintain reliable backups and practice data restoration regularly to minimize downtime in the event of an attack.
• Monitor Around the Clock: Continuous visibility is essential. Organizations without in-house resources can strengthen their resilience by partnering with a trusted Managed Detection and Response (MDR) provider for 24/7 threat monitoring and expert response.

Data for the State of Ransomware in Retail 2025 report comes from a vendor-agnostic survey of 361 retail IT and cybersecurity leaders in organizations with 100-5,000 employees across 16 countries, conducted January – March 2025.