New research finds exploited vulnerabilities and unresolved security gaps remain major risks as retailers prepare for White Friday and the holiday shopping season.
Retailers are recovering faster and paying lower ransoms, but ransomware attacks are becoming more damaging, according to Sophos’ sixth annual State of Ransomware in Retail 2026 report. The study found that 62% of attacks successfully encrypted data, up from 48% in 2025, while average recovery costs increased to $1.76 million.
Based on a survey of 217 IT and cybersecurity leaders across 17 countries whose organisations experienced ransomware in the previous 12 months, the report highlights persistent weaknesses in retail security. The findings are particularly relevant as businesses prepare for White Friday and the holiday shopping season, when disruption to payment systems, inventory, fulfilment and customer services can directly affect revenue and customer confidence.
Exploited vulnerabilities accounted for 26% of ransomware attacks against retailers, the highest proportion across all sectors and above the cross-industry average of 18%. Phishing was the leading technical entry point at 29%, followed by exploited vulnerabilities and malicious email at 22%. Identity-based attack methods collectively initiated 69% of incidents.
“Retailers are paying attackers less and recovering faster than ever before. But with encryption rates up 14 percentage points and known security gaps still behind 38% of attacks, there is no room for complacency.”
— Fayez Eweidat, VP Sales Emerging (META), Sophos
Unresolved security weaknesses were a major contributor. Some 38% of retail victims said attackers exploited a known security gap that their organisation had identified but failed to address. This was the sector’s most frequently reported operational root cause.
The rise in encryption is another concern. Attacks involving both data encryption and theft increased to 19%, compared with 14% in 2025. Yet 71% of retailers restored data from backups, up from 62% the previous year, indicating the growing importance of recovery preparedness.
The financial picture is mixed. The median ransom demand was $225,000, while the median payment was just $57,500—the lowest among the sectors surveyed. However, the average ransom demand reached $4.32 million, reflecting some exceptionally high demands against larger retailers. Average recovery time improved to 2.54 weeks from 3.16 weeks, with 56% of organisations restoring operations within a week. Despite faster recovery, average recovery costs excluding ransom payments rose from $1.65 million to $1.76 million.
Sophos also found that security tools are detecting threats without consistently preventing damage. Although 97% of retail victims affected by credential-based attacks had multifactor authentication enabled, more than half still experienced data encryption. Firewalls flagged 59% of attacks before ransomware deployment, but data was encrypted in 60% of cases where these early warnings appeared.
Fayez Eweidat, VP Sales Emerging (META) at Sophos, said retailers must move beyond deploying individual controls and ensure identity, email, endpoint and network defences work together. He urged organisations to close known vulnerabilities and coordinate security responses before the peak trading period.
Sophos recommends prioritising unresolved vulnerabilities, strengthening identity and access controls, integrating security signals across systems, and regularly testing backup and recovery procedures. The report argues that faster detection must translate into coordinated containment if retailers are to prevent cyber incidents from disrupting critical operations during their busiest trading periods.
