Ransomware — Why prepared organisations are still paying cyber ransoms

Fewer successful breaches, faster payment decisions

Most Australian businesses have the plans, insurance and governance frameworks expected of a mature cyber resilience program, but those that suffer a ransomware attack are now more likely to pay.

Our sixth annual ransomware survey, Under Pressure – Why prepared organisations are still paying cyber ransoms, reveals a fundamental tension where Australian businesses are better equipped to respond and defend against attacks, but are more likely to pay a cyber ransom. Despite widespread insurance coverage, governance frameworks and incident response plans, ransom payments have increased, payments were made faster, and negotiation became less common.

Among the 1,000 Australian business leaders surveyed:

• 69% suffered a ransomware attack in the past five years, and 42% in the last 12 months

• 78% of those that fell victim to an attack in the past five years paid the ransom, a sharp increase from 64% in 2025 

• The average payment rose to $794,000, up from $711,000 in 2025 - but below historical levels

• 40% of those who paid a ransom did so within 24 hours

The McGrathNicol 2026 Ransomware Report, in partnership with YouGov, examines challenges facing boards and executives, including why well-prepared organisations may still pay under pressure. It explores industries including Healthcare and Aged Care, Financial Services, and Technology, and offers steps to help restore operations quickly and avoid rushed payment decisions.
_