Ransomware Cost Russian Firms Up to 1.5B Rubles
In short: On October 14, 2026, Positive Technologies published research on cyberattacks against Russian companies for the period from July 2025 through June 2026. Large businesses lost between 50 million and 1.5 billion rubles per incident involving ransomware or a wiper (data-destruction malware). Core business processes were disrupted in 98% of such attacks, and confidential data leaked in 48% of cases. Small and mid-sized businesses were targeted by ransomware more often than large companies — 39% versus 25% of attacks — and phishing remains the dominant entry point in both segments, behind 60–61% of successful breaches.
What the research found
According to Positive Technologies, the share of attacks using ransomware grew from 29% in 2024 to 33% in 2025, while wipers held steady at 9%. The distinction matters: ransomware demands a ransom to decrypt files, while a wiper destroys data irreversibly — a tactic favored by politically motivated groups and hacktivists (used in up to 88% of their attacks), for whom disrupting infrastructure matters more than money.
Why it's not just an IT problem
The report's headline figure is that 98% of incidents disrupted core business processes — production, logistics, customer service. That's not an abstract "leak somewhere in a database"; it's the company offline for hours or days. Nearly half of attacks (48%) also involved theft of confidential information before or instead of encryption — the now-standard double-extortion pattern, where data is copied first and publication is threatened regardless of whether the victim has backups.
Small business is just as much a target
The common assumption that ransomware only hunts large corporations doesn't hold up: PT found ransomware was used in 39% of attacks on small and mid-sized businesses, notably more often than against large companies (25%). The logic is simple — SMBs typically have weaker defenses and backup practices, raising the odds a victim pays quickly rather than stay offline.
How attackers get in
For both large enterprises and SMBs, the leading entry point is phishing and social engineering — 61% of successful attacks on large companies and 60% on SMBs. That means expensive antivirus tools and backups alone don't close the main door: one employee opening a malicious attachment or clicking a fake link can undo every other layer of defense.
What this means for your own data
Even if you don't run a company, this statistic is personal: a 48% data-leak rate means customer records — including yours — regularly end up in attackers' hands simply because you used an affected organization's service. You can't track every such incident, but you can cut your own risk at the entry point that causes 6 in 10 attacks: phishing. Our guide on spotting modern phishing attempts walks through the current red flags.
No VPN stops ransomware itself — it infects a device through an attachment or link, not a network channel. But when you log into work tools or a personal account over café, airport, or hotel Wi-Fi, encrypting your traffic with LiMP VPN closes a related risk — login credentials being intercepted on someone else's network, which attackers then reuse as another way in. Plans start at 69 ₽/month — see pricing.