Thought Leadership
Companies that pay after an attack usually do not get their data back anyway. A new study reveals how unprepared small businesses are for ransomware and why the ransom trap is so dangerous.
Power out, production halted, attackers demanding money: ransomware hits small and medium-sized enterprises hard, and under pressure, victims often reach for the worst possible option. Paying does not help. That is the sobering conclusion of the Hiscox Cyber Readiness Report, for which market research institute Wakefield Research surveyed around 5,750 professionals across seven countries in the summer of 2025. For the first time, the study focused exclusively on companies with up to 250 employees.
The findings are clear: more than a quarter of German SMEs that paid a ransom never recovered a single piece of data. Another 37 percent managed to retrieve at least parts of their files. In total, roughly two thirds of paying companies got nothing meaningful in return for their money.
Why companies pay anyway
The reasons are understandable: businesses without a working backup have nothing to fall back on after an attack. Add to that the financial pressure of an ongoing operational shutdown and the threat of sensitive data being published, and payment can feel like the fastest way out, even if the data ends up gone regardless.
What actually helps
Klemens Lemke, Underwriting Manager Cyber at Hiscox Germany, advocates a different approach: “We strongly advise against paying a ransom in ransomware cases”, he says. “Experience shows that even after payment, data is very often still lost, systems need to be rebuilt and the risk of further attacks increases.” Instead, Hiscox focuses on prevention, rapid incident response and professional forensic support. Cyber insurance plays a central role in this, less for the financial coverage than for the immediate access to IT specialists who can step in the moment a crisis hits.
