Sophos has released its sixth annual State of Ransomware in Retail report, which shows mixed results for retail ransomware outcomes.

Retail organizations paid less to attackers than any other sector. They also recorded the fastest recovery times in the survey’s history. However, encryption rates climbed by 14 percentage points compared with last year. The average recovery cost rose to $1.76 million.

The findings arrive as retailers prepare for White Friday and the holiday shopping season. During this period, the availability of digital services and operational systems is especially critical. Ransomware can disrupt payment systems, inventory management, order fulfillment and customer service. This puts revenue and customer trust at risk. The report does not measure White Friday-specific attacks. Still, it highlights weaknesses that retailers should address before their busiest trading period.

The report is based on a survey of 217 IT and cybersecurity leaders at retail organizations across 17 countries. All of them were hit by ransomware in the previous 12 months. The survey ran from January to March 2026.

Exploited vulnerabilities hit retail hardest. They were the starting point for 26% of attacks on retailers. This is the highest rate of any sector and well above the 18% cross-sector rate. Phishing was the most common technical root cause at 29%. Malicious email followed at 22%.

Identity-based vectors initiated 69% of attacks on retail. These include malicious email, phishing, compromised credentials and brute-force attacks. This was the lowest rate of any sector. Even so, it still accounted for more than two-thirds of attacks.

Known security gaps were retail’s most common operational weakness. In total, 38% of victims blamed their breach on a gap they knew about but had not addressed. The cross-sector figure was 36%.

Encryption climbed after two years of decline. In total, 62% of attacks successfully encrypted data, up from 48% in 2025. The cross-sector rate was 56%. Attacks involving both encryption and data theft rose to 19%, from 14% last year.

Backups played a major role in recovery. Some 71% of retailers restored data from backups, up from 62% last year. The cross-sector rate was 66%.

Ransom figures were mixed. The median demand was $225,000, the second lowest of any sector. The cross-sector median was $698,000. However, the average demand reached $4.32 million, the highest of any sector. This figure excludes outlier ransoms of $40 million or more. Higher revenue retailers faced some of the highest ransoms across sectors, which pushed the average up. Meanwhile, the median ransom payment was $57,500. This was the lowest of any sector and well below the $769,000 cross-sector median.

Recovery was faster, but costs increased. The average time to fully recover fell to 2.54 weeks, from 3.16 weeks. The cross-sector average was 2.80 weeks. In addition, 56% of retailers recovered within a week, the highest share in five years of retail data. The average recovery cost, excluding any ransom, rose to $1.76 million from $1.65 million. The cross-sector average was $1.70 million.

The report also found that defenses detected attacks but did not always stop them. Almost all retail victims of credential-based attacks had multifactor authentication (MFA) enabled, at 97%. Yet more than half still had data encrypted. Firewalls flagged 59% of attacks before ransomware was deployed. Even then, data was encrypted 60% of the time. The cross-sector figure was 50%.

The findings suggest that security controls detect important signals. However, those signals do not always lead to coordinated action. During a high-pressure period such as White Friday, delays in identifying and containing an attack can have serious operational consequences.

“Retailers have made real progress: they are paying attackers less and recovering faster than ever before. But with encryption rates up 14% and known security gaps still behind 38% of attacks, there is no room for complacency as the White Friday season approaches,” said Fayez Eweidat, VP Sales Emerging (META) at Sophos.

He added, “Retailers’ controls are picking up the right signals, but they need to work together. By closing known gaps and connecting identity, email, endpoint and network defenses so they respond as one, retailers can stop attacks before they disrupt their busiest trading period.”

Sophos outlined several recommendations for retailers:

• Address known security gaps by prioritizing vulnerabilities and issues that have already been identified.
• Strengthen identity security with MFA and robust access controls, while monitoring for compromised credentials and suspicious activity.
• Connect security controls so that identity, email, endpoint and network defenses share signals and respond together.
• Prepare for disruption by testing backup and recovery processes and ensuring teams can respond quickly.

Overall, the data shows progress alongside clear risks. Closing known gaps and connecting defenses may help reduce the impact of retail ransomware during peak trading. The free [State of Ransomware in Retail 2026 report](INSERT LINK) includes the full findings, sector comparisons and recommendations.

Related post

View all