Aussie companies are still paying ransoms - many don’t get their money back
Australian businesses have spent years strengthening cyber defences, investing in new security technologies and expanding security teams. Yet when ransomware strikes, many organisations are still making the same high-stakes decision: should they pay?
According to Commvault's latest State of Data Resilience ANZ 2026 report, around one in three organisations across Australia and New Zealand that experienced ransomware attacks chose to pay the attackers. More troubling still, payment often failed to resolve the crisis, with over one-third of organisations reporting they either never regained access to their data or faced further extortion after paying.
The findings suggest ransomware is no longer simply a technology challenge. It has become a governance issue that demands attention from executive teams and boards alike.
Every minute of operational disruption carries financial consequences.
Lost productivity, interrupted customer services, regulatory obligations and reputational damage can quickly exceed the original cost of the cyber incident itself. Against that backdrop, executives often face enormous pressure to restore operations as quickly as possible.
But paying a ransom rarely provides the certainty organisations hope for.
Cyber criminals have no contractual obligation to honour their promises. Even when decryption keys are provided, organisations can spend weeks rebuilding systems, validating data integrity and restoring operations.
Recovery is therefore determined less by negotiations with attackers and more by preparation before the attack ever occurs.
This is where many organisations remain exposed.
Commvault's research found that while most organisations have identified the business functions they consider essential during a cyber crisis, significantly fewer have identified the underlying applications, infrastructure and data required to keep those functions operating.
That disconnect creates a dangerous blind spot.
Organisations may know that payroll, customer services or manufacturing operations are critical, but unless they understand exactly which systems support those functions—and have tested how quickly they can recover them—they may struggle to resume operations when systems fail.
The challenge is growing as businesses continue embracing artificial intelligence and digital transformation.
AI is accelerating the creation and movement of enterprise data while increasing interdependencies between platforms, cloud environments and business applications. As technology ecosystems become more complex, restoring everything after an incident becomes increasingly unrealistic.
Leading organisations are therefore shifting their focus.
Rather than attempting to recover every system simultaneously, they are identifying the minimum combination of people, technology and information needed to keep the organisation operating. This prioritised approach enables faster recovery, clearer decision-making and greater confidence during periods of disruption.
It also changes the conversation inside the boardroom.
Cyber resilience is no longer measured solely by how effectively organisations prevent attacks. Increasingly, it is judged by how quickly they can recover business operations, maintain customer trust and continue delivering services when attacks succeed.
That requires more than backup infrastructure.
It requires executive ownership of recovery priorities, regular resilience testing and ongoing collaboration between technology leaders and business stakeholders to determine what truly matters most.
Ransomware is unlikely to disappear anytime soon. Criminal groups continue refining their tactics, while businesses continue expanding their digital footprints.
The organisations that will emerge strongest are unlikely to be those with perfect prevention. Instead, they will be those that have already answered the hardest question before an attack begins: if everything stops tomorrow, what absolutely needs to come back first?
For Australian businesses navigating an increasingly volatile cyber landscape, that question may now be one of the most important strategic decisions they make.
