Paying ransoms in ransomware attacks is no longer synonymous with data recovery for Portuguese small and medium-sized enterprises (SMEs). According to Hiscox's "Cyber Preparedness Report 2025," only 59% of SMEs that paid a ransom managed to recover some or all of their information, while more than 40% permanently lost their data.
The study reveals that around a third of Portuguese SMEs were targeted by ransomware attacks in the last year, confirming that this type of cybercrime has become one of the main threats to the national business sector.
Even after paying, 31% of companies saw their data leaked, 19% received ineffective recovery keys, 28% suffered new attacks, and 25% had to completely rebuild their systems. In the end, only 28% managed to completely avoid data exposure.
Avoiding disclosure is the main reason for paying.
Among the SMEs that yielded to the attackers' demands, the main motivation was to prevent the publication of sensitive data. 79% paid to avoid the disclosure of information, and a similar percentage tried to recover the lost data. The report also shows that 84% reconstructed compromised information and 89% resorted to backups.
However, the study demonstrates that these strategies, in isolation, are rarely sufficient to guarantee the protection of digital assets.
The impacts go beyond ransomware.
Beyond ransomware attacks , Portuguese SMEs face multiple consequences associated with cybercrime. Namely, loss of unencrypted data (43%), DDoS attacks (41%), payment diversion fraud (40%), misuse of IT resources (33%), loss of encrypted data without exposure (33%), and viruses not associated with ransomware (29%).
These data show that the digital vulnerability of SMEs is widespread and goes far beyond a single type of threat.
Transparency emerges as a possible response to the growth of this phenomenon. According to the report, 65% of SMEs are in favor of mandatory disclosure of bailout payments, and 56% believe this would help the authorities. Hiscox also notes that 55% consider it would strengthen information for clients and partners, and 52% believe it would reduce stigma. Additionally, 44% associate the measure with strengthening trust.
On the other hand, 35% reject this requirement, fearing greater exposure to attacks, reputational damage, and loss of competitiveness.
Preparation and prevention are crucial.
Ana Silva, cyber lead at Hiscox Portugal and Spain, emphasizes that ransomware has become a highly profitable business model for criminals. “ Paying a ransom does not guarantee the recovery of information nor does it prevent its disclosure. Preparation, prevention, and response capacity are more important today than ever before.”
The official also argues that transparency is a fundamental step in strengthening the digital ecosystem and improving risk management.
