Most mid-market companies think about ransomware as a binary problem: either the backup works and you restore everything, or you pay the ransom and get your files back. The actual experience of a ransomware incident is considerably more complicated, the recovery timeline considerably longer, and the total cost substantially higher than either mental model suggests.
This guide describes what actually happens during a mid-market ransomware incident — based on the incident response patterns documented by cybersecurity firms, government agencies, and insurers — and what the real cost components look like. The goal is to help IT directors and CFOs make informed decisions about prevention investments, backup architecture, and insurance coverage with realistic data rather than optimistic assumptions.
What Actually Happens in a Mid-Market Ransomware Attack
Modern ransomware attacks against mid-market companies follow a predictable sequence. Understanding the sequence matters because the time between initial access and encryption is where most of the damage actually occurs — and where detection and response could have prevented the worst outcomes.
Initial access. The attacker gains a foothold in the environment. For mid-market targets, the most common initial access vectors are: phishing email that delivers malware or harvests credentials, exploitation of a public-facing service with an unpatched vulnerability (VPN, Exchange, RDP), and valid credentials obtained from a previous breach (credential stuffing using email/password combinations from other breached sites).
Reconnaissance and lateral movement. The attacker spends time — often days to weeks — exploring the environment, escalating privileges, discovering what data exists, and identifying backup systems. This dwell time before encryption is when detection through EDR, MDR, or SIEM monitoring could terminate the attack before encryption occurs. Most mid-market companies that experience ransomware do not detect the attacker during this phase.
Data exfiltration. Modern ransomware groups exfiltrate data before encrypting it. This enables "double extortion" — a ransom demand for the decryption key plus a threat to publish the stolen data if not paid. Data exfiltration complicates recovery significantly: even if you restore from backup and avoid paying the decryption ransom, you may still face pressure on the exfiltrated data.
Backup targeting. Sophisticated ransomware groups specifically identify and attempt to destroy or encrypt backup copies before detonating the encryption payload. Windows Volume Shadow Copies are deleted. Networked backup targets are encrypted. Cloud backup credentials accessed through the compromised environment are used to delete cloud backups. Organizations with offline, air-gapped, or immutable backups are significantly better protected at this stage.
Encryption and ransom demand. The encryption payload deploys, often at a time designed to maximize damage (Friday afternoon, holiday weekend) and minimize the time before the affected organization discovers the attack. The ransom note typically provides a contact method (usually a dark web site) and an initial ransom demand.
The Recovery Process: Why It Takes Longer Than Expected
Organizations that have never experienced a ransomware event tend to assume recovery is a matter of restoring backups and resuming operations. The actual recovery process is more involved:
Forensic investigation. Before restoring systems, you need to understand how the attacker got in, what they accessed, and whether they have persistent access (backdoors) that would allow re-entry after restoration. Restoring encrypted systems without conducting forensic investigation and remediation risks restoring malware or leaving attacker persistence mechanisms in place. Forensic investigation takes time — days to weeks for a thorough investigation — and requires specialized expertise. This is why incident response retainers exist.
Clean environment rebuild. Once forensics identifies the scope of compromise, affected systems typically need to be rebuilt from known-clean images rather than simply restored from backup. If the attacker had domain administrator access (common in mid-market incidents), the Active Directory/identity infrastructure itself may need to be rebuilt to eliminate credential compromises.
Prioritized recovery sequencing. Even with good backups, restoration takes time. A 200-person company with several terabytes of data across multiple servers doesn't restore in an afternoon. Recovery is typically sequenced by business criticality — email and core business systems first, then secondary systems. During recovery, the organization operates at degraded capacity for days to weeks.
Business impact during recovery. For most mid-market companies, system unavailability directly translates to revenue impact — orders can't be processed, services can't be delivered, staff can't work effectively. The business interruption component of the total loss is often larger than the direct recovery costs.
What Ransomware Recovery Actually Costs
The total cost of a mid-market ransomware incident has multiple components. These are directional ranges based on publicly available incident response data and cyber insurance loss reports:
Incident response and forensic investigation: $25,000–$150,000 for a mid-market company (100–500 users). Larger environments with more complex forensic requirements run higher.
Recovery labor (IT staff time + contractor help): $20,000–$100,000 depending on the size of the environment and whether the organization's existing MSP can support the recovery or whether specialized help is needed.
System rebuild and remediation: Hardware replacement if hardware was damaged; software licensing for reinstalls; network redesign if the architecture was found to be fundamentally compromised. $10,000–$50,000+ depending on scope.
Business interruption: Revenue losses and extra expenses during the recovery period. For a $10M/year revenue company with a 10-business-day recovery, the direct revenue impact could be $400,000–$500,000 depending on business model. Services businesses with time-sensitive deliverables can see permanent customer loss in addition to direct revenue impact.
Legal and notification costs (if personal data was exfiltrated): Breach counsel, forensic determination of what data was exfiltrated, notification to affected individuals, credit monitoring services, and state AG notification. Notification costs run roughly $3–$8 per affected individual; legal fees for breach response can run $50,000–$200,000+ depending on scope and regulatory involvement.
Ransom payment (if paid): Mid-market ransoms have ranged enormously — from tens of thousands to millions of dollars for larger organizations. Most cybersecurity advisors do not recommend paying ransoms, and FBI guidance discourages it (though the decision is ultimately the organization's). Ransom payments have legal complications including potential OFAC sanctions violations.
Total loss for a significant mid-market ransomware event: $250,000–$2,000,000+ for a 100–500 person company, based on publicly available insurance claims data and industry research. The wide range reflects the variation in recovery complexity, data exfiltration scope, and business interruption severity.
Prevention Investment vs. Recovery Cost
The math on prevention investment is direct. MDR service at $15,000–$30,000/month provides detection capability during the dwell period when most ransomware attacks could be detected and stopped. Annual cost: $180,000–$360,000. Expected loss from a significant ransomware event: $250,000–$2,000,000+. The risk-adjusted calculation favors prevention.
The more targeted investments with the highest prevention ROI: MFA on all systems (eliminates credential stuffing as initial access vector), EDR on all endpoints (detects lateral movement tools), and offline/immutable backup (survives backup-targeting by ransomware groups). These three controls together significantly reduce both the probability and severity of ransomware outcomes. See our EDR guide and backup and disaster recovery guide for the implementation frameworks — plus how to vet a vendor's immutability and air-gap claims, since a backup that an attacker with domain admin can unlock is not the control you think you bought. For a prioritized sequence of these controls mapped to the 2026 breach data, see our Cybersecurity Awareness Month SMB checklist.
The Role of Cyber Insurance
Cyber insurance with business interruption coverage is the risk transfer mechanism for the losses that prevention doesn't eliminate. See our cyber insurance cost guide for current pricing and coverage structure. Key points in the context of ransomware: ensure business interruption coverage limits match your actual revenue exposure, understand how your policy handles data exfiltration events separately from encryption events, and confirm that ransom payments (if you chose to make one) are covered under your policy terms subject to applicable legal restrictions.
Frequently Asked Questions
Should we pay the ransom?
FBI guidance discourages ransom payments, as they fund criminal operations and don't guarantee data recovery or prevent data publication. Most cybersecurity advisors recommend the same. That said, the decision is ultimately a business one that weighs recovery time with and without the decryption key against the ransom amount and legal complications. If you're considering a ransom payment, engage breach counsel immediately — payments to sanctioned entities are prohibited under OFAC regulations, and not all ransomware groups are sanction-free. See our incident response guide for the call sequence when an attack occurs.
How long does ransomware recovery actually take?
For mid-market companies with good backup practices and a competent MSP or IR firm engaged immediately: 5–15 business days to restore core operations. Full recovery to pre-incident operational state typically takes 30–90 days. Organizations without adequate backups or without specialized IR support engaged promptly face significantly longer timelines — some documented cases have run 6–12 months for full recovery.
Will our backups actually work when we need them?
Only if they're tested regularly and structured to survive ransomware backup-targeting. The critical requirements: backup copies that are offline or immutable (ransomware cannot encrypt what it cannot access), tested restoration procedures (not just backup jobs that run successfully), and recovery validation (confirming the backup data is actually consistent and restorable, not just written to the backup target). Annual or quarterly restoration tests are the only way to know this.
What is the difference between incident response and disaster recovery?
Disaster recovery addresses how you restore IT operations after any disruption (hardware failure, natural disaster, ransomware). Incident response addresses how you investigate, contain, and remediate a cybersecurity attack specifically. A ransomware event requires both: incident response to understand and contain the attack, and disaster recovery to restore operations. Many organizations have disaster recovery plans but no incident response capability — which means they can restore backups but don't know how the attacker got in or whether they're still present.
← NY DFS Cybersecurity Regulation | Best Cybersecurity Firms in Indianapolis →