A recent Sophos survey found that the average post-attack remediation costs, including lost business, grew to nearly $2 million in 2021, about 10 times the size of the ransom payment itself.