49% of ransomware victims detect attacks too late

ExtraHop's Global Threat Landscape Report found 49% of ransomware victims detected attacks only after data theft, up from 31% last year. Average dwell time is 2.5 weeks. Attackers exploit encrypted channels, valid accounts, and alert fatigue. Ransom payments fell to $2.8M but payment frequency rose to 83%.