Ransomware encryption rates among retail organisations rose from 48% to 62% year-on-year, according to new research from Sophos released as retailers prepare for the Black Friday and Christmas trading period.
The findings land ahead of what industry forecasts suggest will be a high-spend season in Australia, with the Australian Retailers Association projecting $7.2 billion in spending over Black Friday/Cyber Monday and $77.7 billion in retail sales in the six weeks before Christmas.
Sophos’ sixth annual State of Ransomware in Retail report is based on a survey of 217 IT and cybersecurity leaders at retail organisations across 17 countries that were hit by ransomware in the previous 12 months. The survey was conducted from January to March 2026.
Beyond the increase in successful encryption, the report found that 38% of retail ransomware victims attributed their breach to a known security gap they were aware of but had not addressed. Sophos also reported that exploited vulnerabilities were the starting point for 26% of attacks on retail organisations, the highest rate of any sector surveyed, while identity-based vectors such as phishing, malicious email, compromised credentials and brute-force attacks initiated 69% of attacks.
The report indicates retailers are paying ransoms less frequently and recovering faster, with the average time to fully recover falling to 2.54 weeks, down from 3.16 weeks, and 56% of organisations recovering within a week. However, Sophos said the average recovery cost, excluding any ransom paid, rose to US$1.76 million.
On ransom demands, Sophos reported a median demand of $225,000 and a median payment of $57,500—both among the lowest across sectors. The average ransom demand, however, was reported at US$4.32 million, which Sophos said was the highest of any sector once outlier ransoms of US$40 million or more were excluded.
The report also points to limits in defensive controls during credential-based incidents. Sophos said 97% of retail victims of credential-based attacks had multifactor authentication enabled, yet more than half still had data encrypted. Firewalls flagged 59% of attacks before ransomware was deployed, but in cases where these indicators were present, victims’ data was encrypted 60% of the time.
“Retailers have made real progress: they are paying attackers less and recovering faster than ever before. But with encryption rates up 14 percentage points and known security gaps still behind 38% of attacks, there is no room for complacency as the Black Friday season approaches,” said Aaron Bugal, Field CISO, APJ, Sophos. “Retailers’ controls are picking up the right signals, but they need to work together.
“By closing known gaps and connecting identity, email, endpoint and network defenses so they respond as one, retailers can stop attacks before they disrupt their busiest trading period.”
Sophos’ recommendations for retailers include addressing known security gaps, strengthening identity security, connecting security controls so they can share signals and respond together, and testing backup and recovery processes.
You can read the full report here.
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version=’2.0′;
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window,document,’script’,
‘https://connect.facebook.net/en_US/fbevents.js’);
fbq(‘init’, ‘867017513812619’);
fbq(‘track’, ‘PageView’);
——————————————————–
Click Here For The Original Source.
