510
17 days ago
Ransomware payments drop to record low, even as attacks surge
Summary
Fewer businesses are paying ransomware attackers
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Sign up for breaking news, reviews, opinion, top tech deals, and more.
You are now subscribed
Your newsletter sign-up was successful
Ransomware groups have never been this active, but have also never extorted this little money, new research has claimed.
Market analysts Chainalysis found the number of ransomware incidents in 2025 rose by 50% compared to the previous year, earning criminals $820 million - although this number may still rise as more incidents are attributed to ransomware attacks.
The increase in successful attacks should automatically translate to higher payments, but that didn’t happen - and in fact, Chainalysis says the number of payments remained relatively flat, which in absolute numbers means there were actually a lot fewer companies paying ransomware attackers.
That being said, the researchers believe the number of ransomware victims who actually paid dropped to almost a quarter (28%). This means that for the fourth consecutive years, businesses have been paying less and less to cybercriminals.
In 2024, the payment rate was 62.8%, and a few years prior - in 2022 - it was at 78.9%.
There are numerous reasons causing this trend, the researchers further explain, saying that improved incident response and increased regulatory scrutiny played a major role.
Then, there are effective international actions against ransomware operators, infrastructure, and laundering, which definitely constrained “some revenue flaws”. Finally, errors on the criminals’ side, such as the VolkLocker weakness that allowed free decryption, lifted some of the pressure from the victims.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
But it appears as if hackers don’t really want to work harder, so from those that do pay - they demand more. Chainalysis says that the median ransom payment rose by 368% year-on-year, from $12,738 in 2024 to $59,556 in 2025.
Despite the somewhat grim outlook, ransomware doesn’t seem to be losing its popularity in the criminal underworld. The report states there are currently 85 active extortion groups, a lot more than in previous years. Crooks were most active against US businesses, but those in Canada, Germany, and the UK, as well.
➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
TechRadar is part of Future plc, an international media group and leading digital publisher. Visit our corporate site.
©
Future Publishing Limited Quay House, The Ambury,
Bath
BA1 1UA. All rights reserved. England and Wales company registration number 2008885.
Please login or signup to comment
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Sign up for breaking news, reviews, opinion, top tech deals, and more.
You are now subscribed
Your newsletter sign-up was successful
Ransomware groups have never been this active, but have also never extorted this little money, new research has claimed.
Market analysts Chainalysis found the number of ransomware incidents in 2025 rose by 50% compared to the previous year, earning criminals $820 million - although this number may still rise as more incidents are attributed to ransomware attacks.
The increase in successful attacks should automatically translate to higher payments, but that didn’t happen - and in fact, Chainalysis says the number of payments remained relatively flat, which in absolute numbers means there were actually a lot fewer companies paying ransomware attackers.
That being said, the researchers believe the number of ransomware victims who actually paid dropped to almost a quarter (28%). This means that for the fourth consecutive years, businesses have been paying less and less to cybercriminals.
In 2024, the payment rate was 62.8%, and a few years prior - in 2022 - it was at 78.9%.
There are numerous reasons causing this trend, the researchers further explain, saying that improved incident response and increased regulatory scrutiny played a major role.
Then, there are effective international actions against ransomware operators, infrastructure, and laundering, which definitely constrained “some revenue flaws”. Finally, errors on the criminals’ side, such as the VolkLocker weakness that allowed free decryption, lifted some of the pressure from the victims.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
But it appears as if hackers don’t really want to work harder, so from those that do pay - they demand more. Chainalysis says that the median ransom payment rose by 368% year-on-year, from $12,738 in 2024 to $59,556 in 2025.
Despite the somewhat grim outlook, ransomware doesn’t seem to be losing its popularity in the criminal underworld. The report states there are currently 85 active extortion groups, a lot more than in previous years. Crooks were most active against US businesses, but those in Canada, Germany, and the UK, as well.
➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
TechRadar is part of Future plc, an international media group and leading digital publisher. Visit our corporate site.
©
Future Publishing Limited Quay House, The Ambury,
Bath
BA1 1UA. All rights reserved. England and Wales company registration number 2008885.
Please login or signup to comment
AI Description
The article discusses a paradoxical trend in ransomware attacks, where the number of incidents has surged, yet the total ransom payments have dropped to a record low. This indicates a shift in how businesses are responding to cyber threats.