Ransomware incidence spike met with plummeting payment rates

Only 28% of organizations impacted by ransomware intrusions fulfilled attackers' extortion demands last year, which is the lowest on record, even as attack incidence increased by 50% between 2024 and 2025, reports The Record, a news site by cybersecurity firm Recorded Future.

Nearly $820 million has been paid to ransomware actors in 2025, which could still increase to $900 million after accounting for other incidents and payments, compared with the initial tracking of $813 million and the final total of $892 million recorded in 2024, according to findings from Chainalysis. Improved incident response efforts and more stringent regulations may have prompted a deceleration in ransomware payments. However, median payment size rose from $12,738 in 2024 to $59,565 in 2025 amid more focused attacks against larger organizations, including Jaguar Land Rover, Marks & Spencer, United Natural Foods, and DaVita.

Additional findings revealed that initial access brokers were able to receive nearly $14 million worth of blockchain payments, which could further increase this year. Moreover, intensified law enforcement crackdowns have not prevented ransomware operations from evolving their tradecraft, researchers added.