2025 Ransomware payments decline as victim counts surge
Target Trend
Summary
Hide ▲
Show ▼
Ransomware victim counts surged 50% YoY in 2025 even as total payments fell 8% to $820m, showing that extortion volume rose while monetization weakened. The payment rate collapsed from 63% in 2024 to 29%, while the median payment climbed to $59,556 for victims that still paid. The trend was most visible across the US, Canada, Germany, the UK, and parts of Europe, with heavy hits to manufacturing and finance/professional services.
Related Happenings
Ransomware victim payment rates hit record low as claimed attacks surged
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates hit record low as claimed attacks surged
Target TrendAbout this happening: Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target TrendAbout this happening: Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Ransomware victim listings and active groups surge across 2025
Target Trend
First: 18.02.2026 13:30
Last: 18.02.2026 13:30
Sources 1
About this happening:
**Ransomware** victim listings climbed to **7,458** on leak sites in **2025**, while active groups reached **124**, signaling a broader and more fragmented extortion ecosystem.
Ransomware victim listings and active groups surge across 2025
Target TrendAbout this happening: **Ransomware** victim listings climbed to **7,458** on leak sites in **2025**, while active groups reached **124**, signaling a broader and more fragmented extortion ecosystem.
Chinese money ecosystem shift changes threat-actor operations
Threat Actor Meta
First: 28.01.2026 12:30
Last: 28.01.2026 12:30
Sources 1
About this happening:
**Chinese money laundering networks (CMLNs)** now include **Xinbi**, a Chinese-language marketplace the **UK’s FCDO** sanctioned for selling **stolen data** and **satellite intern...
Chinese money ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: **Chinese money laundering networks (CMLNs)** now include **Xinbi**, a Chinese-language marketplace the **UK’s FCDO** sanctioned for selling **stolen data** and **satellite intern...
Latest development: 26.03.2026 17:42
The UK’s FCDO sanctioned Xinbi, a Chinese-language online marketplace that sells stolen data and satellite internet equipment to scam networks in Southeast Asia, and also targeted #8 Park and Legend Innovation Co as part of the same action; Xinbi is believed to have helped North Korean threat actors launder cryptocurrency stolen in large heists, and Chainalysis says it processed over $19.9 billion between 2021 and 2025.
Record illicit crypto wallet inflows in 2025 despite lower share of blockchain flows
Target Trend
First: 12.01.2026 12:15
Last: 12.01.2026 12:15
Sources 1
About this happening:
**Illicit crypto wallets** received an estimated **$158bn** in **2025**, the highest level seen in five years, even as their share of total crypto activity fell. The increase refl...
Record illicit crypto wallet inflows in 2025 despite lower share of blockchain flows
Target TrendAbout this happening: **Illicit crypto wallets** received an estimated **$158bn** in **2025**, the highest level seen in five years, even as their share of total crypto activity fell. The increase refl...
Timeline
-
02.03.2026 12:45 2 articles · 2mo ago
Ransomware payments fell as victim counts surged in 2025
Campaign Scope UpdateRansomware payments fell 8% to $820m in 2025 even as victim counts rose 50%, making 2025 the most active year on record. Payment rates dropped from 63% in 2024 to 29%, while the median payment rose to $59,556. The trend was especially visible in the US, Canada, Germany, the UK, and other parts of Europe, with manufacturing and finance/professional services among the hardest hit sectors.
Show sources
- Ransomware Payments Decline 8% as Attacks Surge 50% — www.infosecurity-magazine.com — 02.03.2026 12:45
- Ransomware Payments Decline 8% as Attacks Surge 50% — www.infosecurity-magazine.com — 02.03.2026 12:45