The cost of ransomware extends far beyond the ransom

The ransom payment is often only a small part of the total cost of a ransomware incident. IBM's Cost of a Data Breach Report 2025 puts the average total cost at $5.08 million, including downtime, remediation, legal work and business disruption. The median ransom payment was $139,875, according to the 2026 Verizon Data Breach Investigations Report.

The Datto State of BCDR Report 2025 found that more than 60% of organizations believed they could recover in under a day, but only 35% actually did. Longer outages can increase lost revenue, delayed transactions, disrupted customer service and recovery costs.

Regulatory obligations can add further expense. The EU's GDPR requires notification of a qualifying personal-data breach within 72 hours of awareness, while the SEC requires public companies to disclose material cybersecurity incidents within four business days. HIPAA has additional requirements.

Datto says a mature business continuity and disaster recovery (BCDR) strategy can shorten disruption and provide a more predictable recovery path, although it cannot necessarily prevent an attack. In one example, Datto MSP partner Techify restored 19 TB of data and returned a client to full operation in under two hours after ransomware entered through a compromised printer.

Datto BCDR captures system snapshots at intervals as short as five minutes. Its cloud backups use write-once-read-many (WORM) storage, while machine-learning anomaly detection monitors unusual backup activity.