Ransomware Readiness Is a Recovery Problem

The Decision in Front of You

Every board will eventually face a ransom demand, either at its own company or at a supplier the business cannot run without. The decision that matters is made long before that call. It is whether the company has paid for the ability to recover on its own.

Sophos's 2026 survey of 2,158 ransomware victims across 17 countries found that 56% of attacks succeeded in encrypting data, and 48% of organizations with encrypted data paid the ransom ¹. The median payment was $769,000, and the average recovery cost, excluding any ransom, was $1.7 million per incident ¹. A year earlier the median payment was $1 million and the median recovery cost $1.53 million ².

The ransom is the smaller number. Recovery cost, lost revenue, and weeks of manual operations are where boards lose money, and all of them depend on how quickly the company can rebuild from something it trusts.

What's Happening

Attackers go after the backups first

Sophos asked 2,974 victims in early 2024 whether attackers had tried to compromise their backups. Ninety-four percent said yes, and 57% of those attempts succeeded ³. Victims whose backups were compromised paid the ransom 67% of the time, against 36% for those whose backups survived. Their median recovery cost was $3 million, eight times the $375,000 reported by victims with intact backups ³.

The two most recent annual surveys show some improvement and a stubborn gap.

The 2025 backup figure was the lowest in six years ². Even after the 2026 rebound, one encrypted victim in three did not restore from its own backups ¹.

Identity is the front door

Sophos classified 79% of the ransomware attacks in its 2026 survey as starting with an identity-based approach, such as phishing, stolen credentials, or brute force ¹. Its companion review of 661 incident response cases found multifactor authentication (a second proof of identity beyond a password) missing where it mattered in 59% of cases ¹. Partial coverage leaves gaps attackers find: 97% of victims whose root cause was compromised credentials had MFA enabled in some form ¹.

IBM's 2026 Cost of a Data Breach study reported that 39% of organizations said ransomware hit their systems, the fourth straight year of increases, according to a law firm's summary of the report ⁴. In 41% of those attacks, the attackers also went after the victim's brand, through leak sites and public shaming ⁴.

Three recent cases

Change Healthcare, 2024. On February 12, 2024, attackers used stolen credentials to log into a Citrix remote access portal that had no multifactor authentication. They moved through the network for nine days, took data, and then deployed ransomware ⁹. The company's policy required MFA on external systems; this portal was the exception ¹⁰. UnitedHealth's CEO told Congress that the backup systems were locked up as well, because the primary and backup environments were not isolated from each other, and the company rebuilt the platform from scratch ¹⁰. A ransom of $22 million was paid, and some stolen data still appeared online afterward ¹². UnitedHealth reported a 2024 impact of $3.09 billion, including $867 million in business disruption, and advanced $9.03 billion in loans to providers whose payments had stopped ¹¹.

Marks & Spencer, 2025. The retailer disclosed an attack on April 22, 2025, reportedly begun by impersonating staff to IT help desk workers ¹³¹⁴. Online sales of clothing and home goods stopped for weeks and were not expected back until July ¹⁴. Statutory profit before tax for the half year to September 2025 fell from £391.9 million to £3.4 million. One-off incident costs reached about £102 million in that half, with £34 million more expected, partly offset by a £100 million insurance recovery ¹³.

Jaguar Land Rover, 2025. JLR announced an attack on September 2, 2025, shut down its IT systems, and halted vehicle production at its UK plants for about five weeks ¹⁵¹⁶. A phased restart began around October 8 ¹⁶. The company booked £196 million of direct cyber costs in its July to September quarter ¹⁶. The independent Cyber Monitoring Centre estimated the total cost to the UK economy at £1.9 billion, affecting more than 5,000 organizations, and the UK government underwrote a £1.5 billion loan guarantee to keep the supply chain solvent ¹⁵.

The entry points differed: a remote access portal, a help desk, and an intrusion claimed on Telegram by a group calling itself Scattered Lapsus$ Hunters ¹⁶. The weeks of disruption in all three came from rebuilding systems the business could trust again.

Why the Usual Approach Fails

Ransomware budgets tend to flow toward prevention: email filtering, endpoint detection, patching. All of that is necessary. The weakness is that prevention is scored on attacks stopped, and the board has no measure for the attack that gets through.

Several patterns repeat in the public cases.

Backups live inside the blast radius. Backup servers are often joined to the same directory, managed by the same administrator accounts, and reachable on the same network as production. An attacker who holds domain administrator rights can delete snapshots and encrypt the backup catalog with the same keystrokes used on everything else. Change Healthcare's shared primary and backup environments are the public example ¹⁰.

The recovery plan assumes a working identity system. Most restore procedures begin with an administrator logging in. If the directory service is compromised, there is nobody the team can trust to log in, and restoring it from a backup may restore the attacker's accounts along with it.

Credential hardening stops at the login page. M&S shows that the password reset process is itself a credential ¹³. A help desk that can reset an administrator's MFA after a convincing phone call is an open door, however strong the authentication behind it.

Recovery is untested at scale. Restoring one file proves the backup software works. It says nothing about rebuilding hundreds of servers in the right order, with clean images, while the incident response firm is still investigating.

The Framework: Four Recovery Conditions

The question for the board is whether the company can bring its critical services back without the attacker's cooperation, and how long that takes. Four conditions determine the answer. Each needs a named owner and evidence the board can review.

flowchart LR
    A[Unreachable copies<br/>offline or immutable<br/>separate credentials] --> B[Isolated recovery path<br/>clean network<br/>and admin workstations]
    B --> C[Hardened identity<br/>phishing-resistant MFA<br/>verified reset process]
    C --> D[Rehearsed rebuild<br/>golden images<br/>timed restore]
    D --> E[Decision<br/>restore without paying]

Unreachable copies. Keep at least one copy of critical data and system configurations that the production environment cannot alter. CISA, the NSA, and the FBI recommend offline, encrypted backups that are tested for availability and integrity, and warn that many ransomware variants hunt for reachable backups to delete or encrypt them ⁵. Immutable cloud storage, which cannot be changed until a retention period expires, is an acceptable alternative if configured with care ⁵. The copies must sit under different administrator credentials than production. A backup that a stolen domain admin password can delete does not meet this condition.

Isolated recovery path. Plan where the rebuild will happen. That means a network segment, administrator workstations, and tooling that the attacker has never touched. CISA recommends keeping source code, executables, and infrastructure-as-code templates (scripts that rebuild servers and cloud resources automatically) offline alongside the backups, and retaining the hardware needed to restore them ⁵. Restoring into the environment the attacker still controls invites a second encryption.

Hardened identity. Require phishing-resistant MFA on email, remote access, and every account that touches critical systems; separate administrator accounts from everyday ones; restrict who can sign in to domain controllers; and audit privileged accounts every quarter ⁵. Add a verified process for MFA and password resets that cannot be completed on the strength of a phone call. Plan to rebuild the directory service itself from a known-good state, because recovering anything else depends on it.

Rehearsed rebuild. Maintain golden images, which are preconfigured, current templates of critical systems that can be deployed quickly ⁵. NIST's guidance on recovering from ransomware stresses that restored data must be accurate, complete, and free of malware ⁷, so the rebuild includes checking what you restore. Then time it. The board should know the measured hours to restore identity, then the top five business services, from the isolated copies, performed by the people who would do it on the day.

NIST's 2026 ransomware profile maps these outcomes to the Cybersecurity Framework 2.0 and is a reasonable checklist for auditors and insurers ⁶.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. If an attacker held our domain administrator password tonight, which backups could they delete?
2. Where would we rebuild if we could not trust any machine on our network?
3. Which remote access paths do not require MFA today?
4. What would our help desk do if someone claiming to be me called to reset my MFA?
5. How many hours did our last full restore of the directory service take, and when was it?
6. Which five services do we restore first, and in what order?
7. Who has authority to decide on a ransom payment, and who do they call first?
8. What evidence would we give our insurer and auditors that our backups are isolated?

Closing

The decision to pay a ransom is made by engineering choices the company made years earlier. Companies whose backups were reached paid at almost twice the rate of those whose backups survived, and spent eight times as much getting back to work ³. Keep funding prevention, and add the four recovery conditions alongside it. Require a timed rebuild each year and report the hours it took to the board as the measure of ransomware readiness.