Executive Summary

Describing ransomware only as “malicious software that encrypts files and demands a ransom” cannot support decision-making in the field. The primary danger today is not the single process of encryption. In practice, it is a business-disruption and extortion operation that combines intrusion, abuse of credentials, seizure of administrative privileges, lateral movement, data exfiltration, interference with recovery assets, and the threat of both business stoppage and disclosure of information.

The 2025 edition of the Verizon DBIR reports that ransomware was confirmed in 44% of all breaches analyzed, and that by organization size the figure was 39% for large organizations and 88% for small and midsize organizations. The publicly released 2026 edition summary reports 48%. The two figures should not be simply compared as though drawn from the same population and definition, but they agree that ransomware is not a peripheral problem. In IPA’s “Information Security 10 Major Threats 2025,” “Damage from ransomware attacks” ranks first for organizations; this item has been covered in the Top 10 for 10 consecutive years since 2016. [S03][S04][S05] The 2026 edition also maintains this ranking’s first place, making it the top ranking for organizations for 6 consecutive years, 2021 through 2026. [CE1] The Top 10 selection itself has now been compiled for 11 consecutive years, 2016 through 2026 — its 11th edition.

Damage must not be measured by “infection” alone. What stops is not the PC, but order receiving and placement, logistics, medical billing, production planning, payment, customer inquiries, coordination with outsourcing partners, and decision-making itself. The difficulty of recovery depends less on the volume of encrypted data than on whether the scope of compromise can be determined, whether the identity infrastructure can be restored to a trustworthy state, whether backups can be safely restored, and whether the business can be sustained through manual operations.

Conclusions of This Report

1. The center of defense is not perimeter devices alone. Manage identity, endpoints, servers, the cloud management plane, backups, and outsourcing-partner connections as a single attack surface.
2. MFA alone is not enough. Separation of privileged identities, phishing-resistant authentication, conditional access, verification of session and device trust, and inventory of exceptions are all required.
3. It is not enough for backups merely to “exist.” Design must extend to isolation, immutability, restoration testing, recovery sequencing, and preservation of the authentication, keys, and configuration needed for recovery.
4. Detection does not wait for the moment of encryption. Anomalous authentication, privilege changes, access to the management plane, lateral movement, and data collection or exfiltration must be found early.
5. Incident response is not the technical team’s job alone. Coordination with business continuity, legal, public relations, management, insurance, outside experts, and investigative authorities must be decided in advance, during normal operations.
6. Ransom payment is not a recovery plan. Payment does not guarantee decryption, prevention of leakage, or prevention of re-intrusion. It is a management decision that encompasses sanctions, legal, insurance, ethical, and business-continuity considerations. [S01]

Figure 1: A Minimal Model for Capturing Current Ransomware Attacks

Progressing from left to right in the figure is a typical framework for understanding, and does not mean that every incident occurs in the same order or with the same techniques. In particular, “no-ware ransom,” which threatens to publish stolen data without using encryption, also exists. [S07]

Intended Readers and Objectives

The intended audience is engineers responsible for operations, infrastructure, cloud, and security; IT administrators; CSIRT participants; and staff who explain these matters to management. After reading, the goal is to be able to explain the following in one’s own words.

• Why ransomware cannot be prevented by “anti-malware measures” alone.
• The relationship among encryption, data exfiltration, double extortion, RaaS, and supply-chain risk.
• How to translate one’s own organization’s priorities into identity, externally exposed assets, privilege management, backups, monitoring, and recovery exercises.
• How to proceed with technical, management, and external-coordination decisions on the day of discovery without letting them become entangled.

How to Read This Report, and Its Safety Boundary

This report is for defensive and educational purposes. It does not include commands, evasion procedures, intrusion configurations, or malware implementations that could reproduce an attack. At the same time, it explains the objectives of attacks and the observation points necessary for defensive design.

The original research reference date for this report is July 16, 2026. The Current Edition reflects, in limited fashion, updates from material primary sources confirmed through August 20, 2026. Threat-group names, leak sites, payment amounts, and attribution are fluid and are not settled by press reporting alone. In the body of this report, facts are, as a rule, linked to materials in the source ledger, and judgments and outlooks are labeled as such.

Operational judgment: The first place budget should be committed is not necessarily additional product purchases. Until the asset inventory, the list of privileged identities, the externally exposed surface, backup restoration, contact networks, and recovery priorities are made visible, even the effectiveness of existing products cannot be measured.