Nearly six in ten UK ransomware victims paid up despite NCSC warnings, report

UK's ransom payment rate and data exfiltration rate were both above the global average

Nearly six in ten UK ransomware victims paid a ransom despite NCSC guidance not to do so, according to security vendor Proofpoint.

Even so, more than one in five were subsequently targeted for a second extortion payment, the company’s 2026 AI-Era Ransomware Report reveals.

Two-thirds of UK victims (66%) reported data theft during a ransomware incident, with ransomware now a key tool used by criminals in carrying out breaches. Fifty-eight percent paid a ransom, despite official guidance not to do so.

Ransomware evolves

Ransomware is no longer primarily about locking files and charging for a key. Criminals find it more lucrative to steal sensitive data and hold it on threat of release, while also compromising credentials so that a repeated extortion attempts can be carried out. In short, it gives the attackers more options in negotiations.

For the report, Proofpoint surveyed 953 security professionals across 12 countries about ransomware incidents in the past year.

The UK's ransom payment rate and data exfiltration rate were both above the global average, although still well behind the United States, where 93% of affected organisations paid a ransom - nearly double the global average. At the other end of the scale, Italian (19%), French (33%) and Japanese (37%) organisations were significantly less likely to pay.

The report does not speculate on the reasons behind the differences, but it could be that in the US, (and to a lesser extent UEA, India and the UK, all of which were more likely than average to pay up), ransoms are seen as a cost of doing business or covered by insurance, whereas for regulatory or cultural reasons, organisations in Italy, France or Japan are less likely to engage with criminals.

Nor does the report prove that paying a ransom causes repeat extortion, as the question was asked only of organisations that chose to pay. However, it found that 37% of organisations globally that paid a ransom were subsequently hit with a second demand. In the UK, the figure was 22%, suggesting that payment is far from a guaranteed solution.

AI is aiding the attackers

Generative AI is exacerbating the ransomware problem by helping criminals create more convincing phishing emails and impersonation attempts as well as speeding reconnaissance activities.

“This is not a story about AI creating new attack types. It’s about AI making existing human-centric methods harder to detect and more effective at scale,” the report says.

Pressure on defenders is also growing as AI models become better at discovering and exploit zero-day vulnerabilities, narrowing the window between disclosure and exploitation.

The report stresses that ransomware is fundamentally a "people problem", with attackers focusing on trusted communications, identities and human behaviour rather than relying technical exploits alone - although AI may change this balance.

The main attack vectors vary from country to country, but all rely on user interaction. In the UK, malicious links (40%), business email compromise (35%) and credential harvesting (32%) were the most common entry points.

For organisations, the main lesson, according to Proofpoint, is that ransomware has evolved from a malware problem into a broader challenge involving people, identities and trusted communications.