Almost half of ransomware attacks against retailers began from an unknown security gap, based on the latest Sophos State of Ransomware in Retail report. The fifth annual study of the cybersecurity solutions company showed that 46% of incidents were traced to an unidentified weakness in a company’s systems, making it the top operational factor behind these cases.
The report found that 58% of retailers whose data was encrypted decided to pay the ransom. This is the second highest payment rate in five years. Sophos also reported that 48% of attacks resulted in data encryption, the lowest level in the same period.
“Retailers globally are facing a more complex threat landscape where adversaries are constantly on the lookout for and exploiting existing vulnerabilities, most frequently in remote access and internet facing networking equipment,” Chester Wisniewski, director, Global Field CISO of Sophos, said.
Sophos noted several trends shaping the current threat environment. About 30% of attacks used known vulnerabilities, keeping it the top technical root cause for the third straight year. The median ransom demand doubled to $2 million, while the average payment increased by 5% to $1 million.
Sophos X-Ops observed nearly 90 different threat groups targeting at least one retailer over the past year, using ransomware or extortion published on leak sites. The most active groups were Akira, Cl0p, Qilin, PLAY, and Lynx.
After ransomware, account compromise was the second most common type of incident. Retailers also remained targets of business email compromise (BEC) groups attempting to divert payments. These schemes made BEC the third most common incident type.
Limited internal cybersecurity expertise was reported by 45% of respondents, making it the second most common operational factor behind breaches. This was followed by protection gaps at 44%. Sophos said these weaknesses affect how quickly retailers detect and stop attacks.
The report also saw improvements in how the sector responds to threats. More attacks were blocked before encryption, a five-year high for early detection. The drop in encryption cases suggests retailers are becoming better at stopping attacks before they cause serious damage.
Even as ransom demands continue to rise, retail organizations appear more cautious about paying. Only 29% said the amount they paid matched the original demand. About 59% paid less, while 11% paid more. The report added that more retailers may now be seeking expert help when deciding how to respond to a ransomware incident.
“Now, with ransom demands reaching new highs, the need to implement comprehensive security strategies is even more apparent,” Wisniewski said. “Without this, retailers risk ongoing operational disruption and lasting reputational damage that could take years to repair. Encouragingly, many are beginning to recognize this and respond by investing in their cyber defenses, enabling them to stop attacks before they escalate and recover faster.”
The report also noted several additional findings. Extortion-only attacks, where data is not encrypted, rose from 2% in 2023 to 6% in 2025. Backup recovery fell to 62%, the lowest in four years. Recovery costs, excluding ransom payments, dropped by 40% to 1.65 million dollars, a three-year low. Almost half of retail IT and cybersecurity teams reported increased pressure after an encryption event, and about 26% of incidents resulted in changes in leadership.