- Chainalysis finds that ransomware incidents increased by 50% in 2025 and extortion amounted to around $820 million
- The payment rate fell to 28%, down from 62.8% in 2024 and 78.9% in 2022.
- Average ransom payment increased 368% to $59,556
Ransomware groups have never been more active, but they have also never extorted so little money, new research claims.
Market analysts Chainalysis found that the number of ransomware incidents in 2025 increased by 50% compared to the previous year, netting criminals $820 million, although this number may still increase as more incidents are attributed to ransomware attacks.
The increase in successful attacks should automatically translate into higher payouts, but that didn’t happen, and in fact, Chainalysis says the number of payouts remained relatively stable, which in absolute numbers means there were actually far fewer companies paying ransomware attackers.
That said, researchers believe that the number of ransomware victims who actually paid dropped to almost a quarter (28%). This means that, for the fourth year in a row, companies are paying cybercriminals less and less.
In 2024, the payout rate was 62.8%, and a few years earlier, in 2022, it was 78.9%.
There are numerous reasons for this trend, the researchers explain, and they say that better incident response and greater regulatory scrutiny played a major role.
Then, there are the effective international actions against operators, infrastructure and ransomware laundering, which definitely limited “some revenue failures.” Finally, mistakes on the part of criminals, such as the VolkLocker weakness that allowed free decryption, relieved some of the pressure on victims.
But it seems as if hackers don’t really want to work harder, so those who pay demand more. Chainalysis says the average ransom payment increased 368% year-on-year, from $12,738 in 2024 to $59,556 in 2025.
Despite the somewhat bleak outlook, ransomware does not seem to be losing its popularity in the criminal world. The report indicates that there are currently 85 active extortion groups, much more than in previous years. Criminals were most active against American companies, but also against those in Canada, Germany and the United Kingdom.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
