Ransomware payment rates hit a record low among breached companies
Target Trend
Summary
Hide ▲
Show ▼
Ransomware payment rates among breached companies fell to a record low of 23% in Q3 2025, weakening extortion leverage across the victim cohort. The drop matters because more than 76% of observed attacks now involve data exfiltration, and cases that only steal data produced a 19% payment rate. Average and median payments also fell to $377,000 and $140,000, showing shrinking ransom returns. The pattern suggests defenders, legal pressure, and revised payment policies are making ransomware monetization harder even as attackers target more precise opportunities.
Related Happenings
2025 Ransomware victim growth and sector concentration
Target Trend
First: 23.12.2025 15:00
Last: 23.12.2025 15:00
Sources 1
About this happening:
Ransomware activity stayed elevated in **2025**, with **7,902 victims** listed across **306 active groups**, signaling sustained pressure on enterprise targets. The largest concen...
2025 Ransomware victim growth and sector concentration
Target TrendAbout this happening: Ransomware activity stayed elevated in **2025**, with **7,902 victims** listed across **306 active groups**, signaling sustained pressure on enterprise targets. The largest concen...
UK ransomware payment ban and notification proposal
Public Sector Action
First: 03.12.2025 15:25
Last: 03.12.2025 15:25
Sources 1
About this happening:
The **UK government** is advancing a **ransomware payment ban** with **national security exemptions**, a move that would affect **public sector**, **critical national infrastructu...
UK ransomware payment ban and notification proposal
Public Sector ActionAbout this happening: The **UK government** is advancing a **ransomware payment ban** with **national security exemptions**, a move that would affect **public sector**, **critical national infrastructu...
Q3 2025 ransomware cases shift toward compromised VPN credentials
Target Trend
First: 19.11.2025 11:40
Last: 19.11.2025 11:40
Sources 1
About this happening:
**Ransomware surged in Q3 2025**, and **compromised VPN credentials** became the most common initial-access route, increasing exposure across remote-access environments. **Three g...
Q3 2025 ransomware cases shift toward compromised VPN credentials
Target TrendAbout this happening: **Ransomware surged in Q3 2025**, and **compromised VPN credentials** became the most common initial-access route, increasing exposure across remote-access environments. **Three g...
Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Target Trend
First: 14.11.2025 12:37
Last: 14.11.2025 12:37
Sources 1
About this happening:
Ransomware victim disclosures remained **elevated in Q3 2025**, with **1,592 new victims** posted across **more than 85 leak sites**. The average of **535 disclosures per month**...
Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Target TrendAbout this happening: Ransomware victim disclosures remained **elevated in Q3 2025**, with **1,592 new victims** posted across **more than 85 leak sites**. The average of **535 disclosures per month**...
Ransomware-as-a-service ecosystem splinters into 85-group market in Q3 2025
Threat Actor Meta
First: 14.11.2025 12:37
Last: 14.11.2025 12:37
Sources 1
About this happening:
**Q3 2025** marked a major **ransomware ecosystem** shift as **85 active groups** and **14 new brands** pushed the market toward fragmentation. The change raises risk because **fo...
Ransomware-as-a-service ecosystem splinters into 85-group market in Q3 2025
Threat Actor MetaAbout this happening: **Q3 2025** marked a major **ransomware ecosystem** shift as **85 active groups** and **14 new brands** pushed the market toward fragmentation. The change raises risk because **fo...
Timeline
-
27.10.2025 21:22 1 articles · 7mo ago
Coveware reports record-low ransomware payment rates in Q3 2025
Campaign Scope UpdateCoveware reports that ransomware extortion economics weakened in Q3 2025, with just 23% of breached companies paying attackers, while more than 76% of observed attacks involved data exfiltration and data-only extortion cases had a 19% payment rate. The same reporting period saw average and median ransomware payments fall to $377,000 and $140,000, and Akira and Qilin accounted for 44% of recorded attacks while shifting focus toward medium-sized firms, remote access compromise, and software vulnerabilities as larger enterprises revised ransom payment policies and increased defensive spending.
Show sources
- Ransomware profits drop as victims stop paying hackers — www.bleepingcomputer.com — 27.10.2025 21:22