Website Backup & Data Loss Statistics: How Many Businesses Are Actually Protected?
Compiled from Sophos, Veeam, Backblaze, Verizon, IBM and Acronis research — how often backups actually run, how often they save the day after an attack, how much data really comes back, and what a data-loss event costs.
📋 What’s in this page
Key Backup & Data Loss Statistics
Backup adoption is one of those areas where the gap between what businesses believe about their own preparedness and what surveys actually find tends to be wide. Every figure below comes from the original report that published it.
The Backup Gap
Most people and businesses assume they’re backed up in some meaningful sense — a hosting control panel snapshot, an old export, a plugin that runs occasionally. Backblaze has asked U.S. computer owners how often they back up every year since 2008, and the share who do it daily has barely moved.
U.S. computer owners who back up all their data daily
Share of computer owners who back up all the data on their computer at least once a day.
Source: Backblaze annual backup surveys, conducted online by The Harris Poll (about 1,850–1,900 U.S. computer owners each year).Free to reuse with attribution and a link to paidhosting.com
Having a backup and successfully restoring from one are two different things — only 42% of businesses that lost data got all of it back.
Backups vs. Ransom: How Victims Get Their Data Back
Sophos has surveyed IT leaders at organizations hit by ransomware every year since 2020. When attackers encrypt data, victims either restore from backups, pay the ransom, or both — and in 2026 backups recovered from a three-year slide.
Organizations that used backups to recover encrypted data
Share of organizations whose data was encrypted that restored it from backups, by report year.
Source: Sophos, State of Ransomware 2026 (and the 2024 and 2025 editions).Free to reuse with attribution and a link to paidhosting.com
| Report year | Attacks that encrypted data | Used backups to recover | Paid the ransom |
|---|---|---|---|
| 2020 | 73% | 56% | 26% |
| 2021 | 54% | 57% | 32% |
| 2022 | 65% | 73% | 46% |
| 2023 | 76% | 70% | 46% |
| 2024 | 70% | 68% | 56% |
| 2025 | 50% | 54% | 49% |
| 2026 | 56% | 66% | 48% |
Source: Sophos, State of Ransomware 2025 and 2026. “Used backups” and “paid the ransom” are shares of organizations whose data was encrypted; many did both. Each report covers attacks in the 12 months before the survey.
Attackers Go After the Backups First
Modern ransomware groups know a working backup is the one thing that lets a victim refuse to pay — so they try to destroy it. Sophos’s 2024 study of 2,974 ransomware victims measured what happens when they succeed.
Backups compromised
- 67% paid the ransom
- Median ransom demand: $2.3M
- Median recovery cost: $3M
- Only 26% fully recovered within a week
Backups not compromised
- 36% paid the ransom
- Median ransom demand: $1M
- Median recovery cost: $375K
- 46% fully recovered within a week
Source: Sophos, The Impact of Compromised Backups on Ransomware Outcomes (survey of 2,974 organizations hit by ransomware, conducted by Vanson Bourne in early 2024). Attackers tried to compromise backups at 94% of these organizations, and 57% of those attempts succeeded.
How Much Data Actually Comes Back
Even with backups in place, full recovery after an attack is the exception rather than the rule.
The Cost of Data Loss
Costs scale with organization size, but even the smaller figures below are significant for a small business or a site that earns its revenue online.
| Measure | Figure | Source |
|---|---|---|
| Global average cost of a data breach | $4.99M | IBM, 2026 |
| Average cost of a data breach in the U.S. | $11.5M | IBM, 2026 |
| Average ransomware recovery cost, excluding any ransom | $1.7M | Sophos, 2026 |
| Median ransomware recovery cost, excluding any ransom | $375K | Sophos, 2026 |
| Median ransom payment | $769K | Sophos, 2026 |
| Median insured breach loss for a small or medium business | ~$38K | Verizon Breach Impact Study, 2026 |
IBM figures cover 602 organizations with breaches between March 2025 and February 2026. Verizon’s Breach Impact Study is based on paid cyber-insurance claims, so its figures are likely minimums; it found SMB losses can reach up to 7% of total revenue, and ransomware made up 39% of SMB claims.
The Ransomware Threat in 2026
Ransomware remains the scenario most directly tied to backup readiness — a working, isolated backup is often the difference between a contained incident and a business-ending one.
Acronis’s H2 2025 Cyberthreats Report found that ransomware attacks rose 50% year over year through October 2025, and that almost 150 managed service providers and telecom companies fell victim. Phishing (52%) and unpatched vulnerabilities (27%) were the two leading ways into the service providers it studied — both squarely within a typical website owner’s control. 80% of ransomware-as-a-service vendors now advertise AI or automation features to their criminal customers.
What This Means for Your Website
The single biggest risk this data points to isn’t the absence of a backup — it’s one that can’t be restored. With only 28% of ransomware victims getting all of their data back, and attackers going after backups at 94% of victims, “we have backups” and “we can recover from a real incident” are different claims. Testing a restore periodically, keeping at least one backup copy offline or immutable (so ransomware can’t encrypt or delete it alongside everything else), and confirming your host’s backup retention window actually matches how quickly you’d notice a problem are the three highest-leverage steps this data supports.
Sources & Methodology
Every figure on this page is taken from the original report that published it, not from secondary roundups. Ransomware recovery, backup-use and ransom figures come from Sophos’s annual State of Ransomware surveys of organizations hit by ransomware, and its 2024 study on compromised backups. Data-recovery figures come from Veeam’s 2026 Data Trust and Resilience Report and 2025 Ransomware Trends Report. Personal backup habits come from Backblaze’s annual surveys conducted by The Harris Poll. Breach and cost figures come from Verizon’s 2026 Data Breach Investigations Report and Breach Impact Study and IBM’s 2026 Cost of a Data Breach report. Attack-trend figures come from Acronis’s H2 2025 Cyberthreats Report. Sophos figures describe organizations with 100 to 5,000 employees; Backblaze figures describe U.S. computer owners. This page is reviewed and updated as newer annual reports are published.
- Sophos — State of Ransomware 2026, 2025 and 2024; The Impact of Compromised Backups on Ransomware Outcomes (2024)
- Veeam — Data Trust and Resilience Report 2026; 2025 Ransomware Trends and Proactive Strategies Report
- Backblaze / The Harris Poll — backup surveys 2021, 2022 and 2024
- Verizon — 2026 Data Breach Investigations Report; 2026 Breach Impact Study
- IBM — Cost of a Data Breach Report 2026
- Acronis — Cyberthreats Report H2 2025
Cite this analysis
https://www.paidhosting.com/website-backup-data-loss-statistics/
Findings on this page may be reproduced with attribution and a link back to this page. Press and data inquiries: [email protected]