Ransomware Payments Decline Despite Surge in Attacks

In 2025, ransomware incidents surged by 50%, with extortion efforts totaling approximately $820 million, according to a report by Chainalysis. Despite this increase in attacks, the payment rate from victims dropped to a record low of 28%, down significantly from 62.8% in 2024 and 78.9% in 2022. This paradox highlights a growing disconnect between the frequency of ransomware attacks and the willingness of victims to pay ransoms.

TechRadarRansomware payments at record low

The median ransom payment experienced a dramatic increase of 368%, rising from $12,738 in 2024 to $59,556 in 2025. While the overall revenue from ransomware decreased by 8% compared to the previous year, this was attributed to a significant drop in the number of companies willing to pay. The number of active ransomware groups has also expanded, with 85 groups currently operating, indicating a fragmented landscape in the ransomware economy.

TechRadarRansomware payments at record low

Several factors contribute to the declining payment rates. Improved incident response strategies, heightened regulatory scrutiny, and effective international actions against ransomware operators have all played a role in reducing the number of victims who comply with ransom demands. Additionally, technical failures on the part of criminals, such as vulnerabilities in ransomware systems, have allowed some victims to recover data without paying.

TechRadar

Experts have noted that the current landscape reflects a shift in ransomware tactics rather than a retreat from criminal activities. Corsin Carmichael, founder of eCrime.ch, stated, “The assumption is simple - smaller victims pay faster.” However, the data indicates that payments are trending downward despite an increase in public claims of attacks. This suggests that attackers are facing diminishing returns, requiring them to adapt their strategies to extract more value from a shrinking pool of victims.

Ransomware payments at record low

Chainalysis emphasizes that the ransomware market is evolving, with a marked fragmentation of major ransomware-as-a-service operations. This shift has led to a proliferation of smaller, less centralized attackers focusing on small and medium-sized enterprises (SMEs). The report authors believe that ransomware operators are adapting their tactics to continue extracting value despite the challenges posed by a more resilient victim base.

Ransomware payments at record low

While the reported total revenue from ransomware attacks in 2025 stands at $820 million, there are indications that this figure may rise as more incidents are attributed to ransomware. The 2024 revenue figure was also revised from an initial estimate, highlighting potential discrepancies in reporting and the evolving nature of ransomware economics.

TechRadar

The ransomware landscape in 2025 presents a complex picture: while attacks have increased, the willingness of victims to pay has decreased significantly. This trend, driven by improved defenses and changing criminal tactics, suggests that the ransomware economy is undergoing a significant transformation.

TechRadar