Bad news: Paying a ransomware lawsuit could make hackers come back and ask for more

Proofpoint 2026 AI-Era Ransomware report found that 54% of victims paid attackers despite warnings
37% faced repeated extortion after paying; 2% paid but never regained access to files
Experts urge prevention: phishing awareness, offline backups and AI-based endpoint protection

Security researchers at Proofpoint have apparently proven once again that paying ransomware actors doesn’t guarantee they’ll be gone forever; In fact, they have shown that in many cases, they will simply come back for more because they know they can get paid.

The company’s “AI Era Ransomware Report 2026,” based on a survey of nearly 1,000 security professionals across 12 markets, found that globally, more than half (54%) of affected organizations paid their attackers to regain access to locked files and prevent them from sharing stolen documents on the dark web.

This is despite repeated pleas from law enforcement and the cybersecurity industry not to engage with the attackers and, under any circumstances, to pay the requested ransom. Proofpoint argues that the real-world pressure organizations face when faced with disruptions is, in many cases, simply too great to tolerate.

Request a second payment

The logic behind the “don’t pay” argument is simple: by paying, victims motivate attackers to cause more damage and fund future attacks. At the same time, there is no guarantee that the decryption keys will work, that the attackers will actually delete the files they had stolen, and that they will not attack again in a few weeks.

This final argument has now been proven. While around half (56%) of victims paid a ransom and regained access, more than a third (37%) faced a second extortion demand shortly after paying. Another 2% paid and never regained access.

Instead of paying the ransom demand, the industry suggests that companies protect their facilities by educating their employees about the dangers of phishing, maintaining up-to-date backups in offline storage, and running (if possible, powered by AI) endpoint detection and protection services across the technology stack.

Through TechCrunch