Nearly half of retail ransomware attacks stem from unknown vulnerabilities: Sophos

Sophos, a global leader of innovative security solutions for defeating cyberattacks, has released its fifth annual Sophos State of Ransomware in Retail report, a vendor-agnostic survey of IT and cybersecurity leaders across 16 countries.

- 

This year’s report reveals that nearly half (46 percent) of retail ransomware incidents were traced to an unknown security gap, underscoring ongoing visibility challenges across the retail attack surface. Among organizations that had data encrypted, 58 percent paid the ransom to get their data back — the second highest payment rate in five years.

> 46 percent of attacks began with an unknown security gap (top operational factor)

> 30 percent of attacks exploited known vulnerabilities (top technical root cause, third year running)

> 58 percent of victims with encrypted data paid; 48% of attacks resulted in encryption (five-year low)

> Median ransom demand doubled to US$ 2 million from 2024; average payment increased 5 percent to US$1 million

In the past year, the Sophos X-Ops has observed nearly 90 distinct threat groups target one or more retailers with ransomware or extortion across leak sites. The most active groups Sophos has tracked from incident response and MDR cases are Akira, Cl0p, Qilin, PLAY, and Lynx.