Ransomware Payment Rates Plummet to Record Lows in 2025: Key Drivers and Industry Impacts

A record-breaking drop in ransomware payment rates has emerged as one of the most surprising cybersecurity trends of 2025, even as the frequency of attacks continues to climb. Only 28% of ransomware victims opted to pay their attackers last year—a dramatic shift from the nearly 80% payment rate seen just three years prior. This transformation is not the result of a single factor, but rather a convergence of improved incident response, regulatory crackdowns, and a growing skepticism toward cybercriminal promises.

Organizations have become more resilient, leveraging layered defenses, immutable backups, and rapid restoration protocols to bounce back from attacks without succumbing to extortion. Meanwhile, governments and regulators have tightened the screws, making ransom payments riskier from a legal standpoint. The ransomware landscape itself has fractured, with a proliferation of Ransomware-as-a-Service (RaaS) groups and inconsistent negotiation tactics, further eroding trust in the “honor among thieves” that once governed these transactions. High-profile law enforcement takedowns and the public release of free decryption tools have also empowered victims to resist demands.

This analysis unpacks the key drivers behind the historic decline in payment rates, drawing on the latest data and real-world examples to illuminate how organizations are turning the tide against ransomware.

Why Are Fewer Organizations Paying Ransomware Demands?

Enhanced Incident Response and Preparedness

The decline in ransomware payment rates is closely tied to significant advancements in organizational incident response capabilities. Over the past several years, businesses have invested heavily in cybersecurity training, tabletop exercises, and incident response planning. These efforts have resulted in faster detection, containment, and recovery from ransomware attacks, reducing the perceived necessity to pay ransoms.

Organizations increasingly deploy layered defense strategies, including endpoint detection and response (EDR), network segmentation, immutable backups, and rapid restoration protocols. These measures ensure that, even in the event of successful encryption, critical data can be restored with minimal downtime, undermining the leverage of ransomware operators. Notably, the four-year downward trend in payment rates—culminating in a record low of 28% in 2025—reflects the growing efficacy of these defensive postures.

Table 1: Key Incident Response Improvements

Source: Chainalysis, 2026

Regulatory and Legal Pressures

The global regulatory landscape has evolved to discourage ransom payments. Governments and regulatory bodies in the United States, European Union, and other jurisdictions have issued advisories and, in some cases, enacted legislation that either restricts or outright prohibits the payment of ransoms to sanctioned entities or in specific circumstances. This regulatory scrutiny has forced organizations to reconsider the legal ramifications of making payments, especially when there is a risk of violating anti-money laundering (AML) or counter-terrorism financing (CTF) laws.

Legal counsel and compliance teams now play a central role in incident response, often advising against payment unless all other options are exhausted and legal exposure is minimal. The threat of regulatory penalties, reputational damage, and potential criminal liability has shifted the risk calculus for many organizations, contributing to the historic drop in payment rates.

Table 2: Regulatory Actions Impacting Payment Decisions

Source: Chainalysis, 2026; Regulatory advisories

Erosion of Trust in Ransomware Operators

A critical factor in the declining payment rate is the growing skepticism regarding cybercriminals’ promises. Historically, ransomware operators offered assurances that payment would result in decryption keys and the deletion of stolen data. However, a pattern of broken promises, double extortion tactics, and repeated leaks—even after payment—has undermined trust in these assurances.

Victims increasingly recognize that paying a ransom does not guarantee the safe return of data or prevent further extortion. The proliferation of data leak sites and the commoditization of stolen data have made it clear that attackers may monetize information regardless of payment. This erosion of trust is reflected in the willingness of only 28% of victims to pay in 2025, compared to nearly 80% three years prior.

Table 3: Ransomware Operator Reliability Trends

Source: Chainalysis, 2026

Market Fragmentation and Ransomware-as-a-Service (RaaS) Proliferation

The ransomware ecosystem has undergone significant fragmentation, with an increase in the number of active extortion groups and the widespread adoption of Ransomware-as-a-Service (RaaS) models. In 2025, analysts observed 85 active extortion groups, a substantial rise from previous years, when a handful of groups dominated the landscape.

This fragmentation has led to inconsistent negotiation practices, varying levels of technical sophistication, and unpredictable outcomes for victims. The lack of centralized control among threat actors has further eroded confidence in the efficacy of ransom payments, as victims cannot reliably anticipate the behavior or intentions of disparate groups. The increased competition among threat actors has also resulted in a “race to the bottom,” with some groups demanding exorbitant sums while others settle for smaller, quick payments, complicating the decision-making process for victims.

Table 4: Ransomware Market Fragmentation

Source: Chainalysis, 2026

Increased Law Enforcement and International Collaboration

The international law enforcement community has intensified efforts to disrupt ransomware operations, dismantle infrastructure, and apprehend key actors. High-profile takedowns, coordinated by agencies such as Europol, Interpol, and the FBI, have resulted in the seizure of ransomware infrastructure, arrests of operators, and the public release of decryption tools.

These efforts have increased the risk for both ransomware operators and their affiliates, leading to operational disruptions and a heightened sense of uncertainty within the criminal ecosystem. For victims, the prospect of law enforcement intervention and the availability of free decryption tools have provided viable alternatives to ransom payment. Organizations are now more likely to report incidents to authorities, leveraging government support and resources to recover from attacks without succumbing to extortion.

Table 5: Law Enforcement Impact on Ransomware Payments

Source: Chainalysis, 2026; Law enforcement press releases

Shifts in Ransomware Economics and Victim Calculus

While the aggregate revenue from ransomware activity has declined, the median ransom payment has surged—rising 368% from $12,738 in 2024 to $59,556 in 2025. This shift reflects a strategic pivot by threat actors: rather than pursuing a high volume of low-value payments, they now target fewer victims but demand higher sums, often from organizations perceived as more likely to pay.

This economic recalibration has paradoxically contributed to the lower payment rate. Many organizations, faced with exorbitant demands, opt to absorb the costs of recovery rather than acquiesce to ransom demands. The calculus is further influenced by the realization that paying large ransoms does not guarantee business continuity or prevent future targeting. The increased financial burden, coupled with the aforementioned factors—regulatory risk, lack of trust, and improved preparedness—has made non-payment the rational choice for a growing number of victims.

Table 6: Ransom Payment Amounts and Victim Response

Source: Chainalysis, 2026

Influence of Initial Access Broker (IAB) Market Dynamics

The ecosystem of initial access brokers (IABs)—entities that sell access to compromised networks—has also undergone significant changes. In 2025, IABs generated $14 million, consistent with the previous year, but this represented only 1.7% of total ransomware revenue. The average price for network access has dropped sharply, from $1,427 in Q1 2023 to $439 in Q1 2026, due to automation, AI-driven tooling, and an oversupply of compromised credentials.

This commoditization of initial access has led to a surge in attack volume, but not necessarily in attack quality or success. Many attacks are opportunistic, targeting organizations with robust defenses and little incentive to pay. As a result, the sheer volume of attacks has not translated into higher payment rates; instead, it has diluted the impact of each individual attack and further normalized non-payment as a viable response.

Table 7: IAB Market Trends

Source: Chainalysis, 2026

Organizational Culture and Board-Level Involvement

The cultural shift within organizations regarding cyber extortion has been profound. Executive leadership and boards of directors are now more engaged in cybersecurity governance, often setting explicit policies against ransom payments. This top-down approach is reinforced by cyber insurance carriers, many of whom have tightened policy terms or excluded ransom payments from coverage.

As a result, incident response teams are empowered to resist extortion attempts, and the stigma associated with paying ransoms has grown. Peer benchmarking and industry consortiums further reinforce this stance, as organizations share best practices and success stories of recovery without payment. The normalization of non-payment as a best practice is both a cause and effect of the declining payment rate.

Table 8: Organizational Policy Trends

Source: Chainalysis, 2026; Industry surveys

The Role of Public Awareness and Media Coverage

Finally, increased public awareness and comprehensive media coverage of ransomware incidents have played a pivotal role in shaping organizational responses. High-profile breaches and the publication of victim stories have demystified the ransomware threat, highlighting both the risks of payment and the successful recovery strategies employed by non-paying organizations.

This transparency has fostered a more informed decision-making environment, where organizations are less likely to panic and more likely to follow established protocols. The collective knowledge base, bolstered by industry reports and government advisories, has contributed to a culture of resilience and resistance, further driving down payment rates.

Table 9: Public Awareness Impact

Source: Chainalysis, 2026; Media analysis

All data and trends referenced in this report are drawn from the latest BleepingComputer and Chainalysis analyses as of February 26, 2026.

Final Thoughts

The sharp decline in ransomware payment rates signals a pivotal moment in the ongoing battle between defenders and cybercriminals. Organizations are no longer defaulting to ransom payments as a quick fix; instead, they’re investing in robust defenses, collaborating with law enforcement, and embracing a culture of resilience. The surge in attack volume—fueled by cheaper initial access and the rise of RaaS—has not translated into higher profits for attackers, thanks to improved preparedness and a collective refusal to play by the criminals’ rules.

As AI-driven attacks and IoT vulnerabilities continue to evolve, the cybersecurity community must remain vigilant. However, the normalization of non-payment, coupled with regulatory pressure and public awareness, offers a blueprint for reducing the impact of ransomware globally. The lessons learned from 2025’s record-low payment rates will shape the strategies of both defenders and attackers in the years ahead.

References

• Toulas, B. (2026, February 26). Ransomware payment rate drops to record low despite attack surge. BleepingComputer. https://www.bleepingcomputer.com/news/security/ransomware-payment-rate-drops-to-record-low-despite-attack-surge/