A industry report focused on retail ransomware shows that 58% of retail organisations whose data was encrypted paid the ransom to recover their data, a sharp rise from prior years and well above the cross-sector average. Sophos released its fifth annual Sophos State of Ransomware in Retail report, a vendor-agnostic survey of IT and cybersecurity leaders across 16 countries. This year’s report reveals that nearly half (46%) of retail ransomware incidents were traced to an unknown security gap, underscoring ongoing visibility challenges across the retail attack surface.
In the past year, Sophos X-Ops observed almost 90 different threat groups attack one or more retailers with ransomware or extortion. The most active groups were Akira, Cl0p, Qilin, PLAY, and Lynx. After ransomware, the second most common type of attack was account compromise. Like many other industries, retailers are also often targeted by business email compromise (BEC) groups. These groups try to trick companies into sending money to the wrong accounts.
“Retailers all over the world are facing more complicated threats. Cyber Attackers are always looking for weaknesses, especially in systems connected to the internet. Ransom demands are rising. The good news is that many retailers are starting to understand this and are investing in better cyber defences to stop attacks early and recover more quickly,” says Chester Wisniewski, director, global field CISO at Sophos.
Limited in-house expertise was the second-most common operational driver of compromise (45%), followed by insufficient protection (44%). If retailers lack the right skills and protections, it is hard for them to detect and stop cyber attacks.
The average ransom payment in retail increased by 5% ($1 million in 2025, up from $950,000 in 2024). However, the average payment is only half of what criminals initially ask for. This shows that retailers are more likely to resist high demands and may be getting expert help to handle ransomware attacks.
According to the State of Ransomware in Retail report 2025
Data encryption is becoming less common, but criminals are changing their tactics. The number of retailers hit by extortion-only attacks has tripled, from 2% in 2023 to 6% in 2025.
Backup rates are falling; 62% of retailers who experienced attacks restored their data using backups, the lowest rate in four years.
Retailers are pushing back against ransom demands. Only 29% paid the full amount asked at first. 59% paid less than the first request, and 11% paid more.
Recovery costs are going down. The average cost to recover from a ransomware attack (not including the ransom payment) dropped by 40% in the last year to $1.65 million, the lowest in three years.
Ransomware attacks had a big effect on teams. Almost half (47%) of retail IT and cybersecurity teams felt more pressure after experiencing data encryption, and in 26% of cases, leaders were replaced because of attacks.
Marks & Spencer (M&S) (Ransomeare reported in 2025): a ransomware incident disrupted online operations and store support systems, with analysts estimating tens of millions in short-term profit impact and negative market reaction; M&S reportedly chose not to pay and pursued system rebuild, illustrating the tradeoff between paying vs rebuilding (and the possible long recovery cost of refusal).
Also Read: Top 10 agentic AI threats, and how to defend against them
