Recovery remains expensive for financial organizations already hit by ransomware, according to Sophos’s 2026 sector survey. Mean recovery spending was $1.50 million, excluding ransom payments. The median was $750,000, twice the $375,000 median across sectors.
The financial-services report covers 177 IT and cybersecurity leaders in banking, financial services and insurance whose organizations experienced ransomware in the preceding 12 months. Fieldwork ran from January to March 2026. These are victim-survey findings, not an estimate of the proportion of all financial firms attacked.
Sophos reports that identity-related entry vectors accounted for 85% of attacks. Separately, 44% of respondents cited a security weakness they already knew about but had not resolved. The company recommends coordinating identity, email, endpoint and network defenses.
Recovery spending and ransom payments are separate budgeting measures. The difference between mean and median also shows why one figure cannot describe every respondent’s experience.
