Ransomware payments drop to record low, even as attacks surge

• Chainalysis finds ransomware incidents rose 50% in 2025, extortion totaled around $820m
• Payment rate dropped to 28%, down from 62.8% in 2024 and 78.9% in 2022
• Median ransom payment surged 368% to $59,556

Ransomware groups have never been this active, but have also never extorted this little money, new research has claimed.

Market analysts Chainalysis found the number of ransomware incidents in 2025 rose by 50% compared to the previous year, earning criminals $820 million - although this number may still rise as more incidents are attributed to ransomware attacks.

The increase in successful attacks should automatically translate to higher payments, but that didn’t happen - and in fact, Chainalysis says the number of payments remained relatively flat, which in absolute numbers means there were actually a lot fewer companies paying ransomware attackers.

Extracting value from victims

That being said, the researchers believe the number of ransomware victims who actually paid dropped to almost a quarter (28%). This means that for the fourth consecutive years, businesses have been paying less and less to cybercriminals.

In 2024, the payment rate was 62.8%, and a few years prior - in 2022 - it was at 78.9%.

There are numerous reasons causing this trend, the researchers further explain, saying that improved incident response and increased regulatory scrutiny played a major role.

Then, there are effective international actions against ransomware operators, infrastructure, and laundering, which definitely constrained “some revenue flaws”. Finally, errors on the criminals’ side, such as the VolkLocker weakness that allowed free decryption, lifted some of the pressure from the victims.

But it appears as if hackers don’t really want to work harder, so from those that do pay - they demand more. Chainalysis says that the median ransom payment rose by 368% year-on-year, from $12,738 in 2024 to $59,556 in 2025.

Despite the somewhat grim outlook, ransomware doesn’t seem to be losing its popularity in the criminal underworld. The report states there are currently 85 active extortion groups, a lot more than in previous years. Crooks were most active against US businesses, but those in Canada, Germany, and the UK, as well.

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.