Ransomware Payments Hit Record Low as Companies Refuse to Bow to Hackers

The Digital Fightback Against Cyber Extortion Gains Momentum

For the first time in years, the global ransomware economy is gasping for air. A new Coveware report reveals that only 23% of breached organizations paid their attackers in the third quarter of 2025 — the lowest figure on record. What was once a lucrative business for cybercriminals is now showing cracks, as corporations grow bolder, law enforcement grows sharper, and public awareness of ransomware’s devastating ripple effects deepens.

This milestone marks a significant victory for the cybersecurity community. The drop from 28% in early 2024 to 23% in late 2025 signals a cultural and strategic shift: businesses are learning not just to defend themselves, but to resist digital blackmail altogether. For hackers, who once thrived on fear and urgency, this new reality threatens their profit pipelines.

🧩 Summary: Global Ransomware Payouts Collapse as Defenses Strengthen

The number of victims paying ransomware gangs has fallen to just 23%, according to data from Coveware. This steady decline continues a six-year trend of reduced payment resolutions, reflecting growing resilience and improved preparation among organizations. In the first quarter of 2024, the rate stood at 28%, briefly rose, then plunged to its lowest point ever by Q3 2025.

Experts attribute this drop to two key factors: stronger cyber defense mechanisms and increased government pressure discouraging ransom payments. Coveware hailed this as a collective achievement by “cyber defenders, law enforcement, and legal specialists,” emphasizing that each avoided payment “deprives attackers of oxygen.”

Meanwhile, the nature of ransomware itself has evolved. Where attackers once relied solely on encryption-based extortion, most now use double extortion tactics—stealing data before threatening to leak it publicly. In Q3 2025, 76% of ransomware incidents involved data exfiltration, a record high.

Interestingly, when isolating attacks involving only data theft and no encryption, the payment rate drops to just 19%, another all-time low. Financially, the average ransom payment fell to $377,000, while the median dropped to $140,000, suggesting that even when payments occur, they are smaller.

This trend points to changing corporate strategies. Many large enterprises are revising their ransom policies, choosing instead to channel funds into cyber resilience and defense rather than paying criminals. However, the report warns that as profits shrink, ransomware groups such as Akira and Qilin—responsible for 44% of recorded attacks in Q3 2025—are shifting focus toward medium-sized firms, where defenses are weaker and the chance of payment is higher.

Another growing risk vector is remote access compromise and software vulnerability exploitation, both of which have surged in the past year. Coveware predicts that as major corporations harden their systems, hackers will increasingly rely on social engineering and insider recruitment, offering hefty bribes to employees who can grant them a digital foothold.

The findings coincide with data from the Picus Blue Report 2025, which noted a 2x increase in password cracking incidents, with 46% of environments breached through compromised credentials—up from 25% the previous year. Together, these reports paint a picture of a cyber landscape in transition: one where hackers are adapting, but defenders are finally catching up.

🔍 What Undercode Say: The Economics of Extortion Are Breaking

Ransomware once thrived on fear and unpreparedness. Companies, terrified of data loss and operational shutdowns, often paid millions within hours to decrypt their files or prevent leaks. But 2025 marks the year that calculus began to change.

First, insurance and legal ecosystems have evolved. Cyber insurance providers are tightening policies, often refusing to reimburse ransom payments unless all defensive measures were proven to be in place beforehand. This discourages blind payouts and pushes organizations to invest in proactive defense.

Second, governments across Europe and North America are increasingly discouraging ransom payments, warning that paying can violate sanctions or indirectly fund organized crime. The U.S. Treasury’s Office of Foreign Assets Control (OFAC), for instance, has repeatedly flagged payments to sanctioned entities as potential legal violations.

Third, the rise in data leak fatigue has changed the psychology of ransom negotiations. Once, the threat of a leak was devastating. Now, with regulatory frameworks like GDPR and new data protection norms, companies are better equipped to handle the fallout—often disclosing incidents transparently instead of succumbing to blackmail.

Moreover, the falling ransom averages show that large corporations are taking back control. The balance of power is shifting: what was once a billion-dollar criminal market is now a fight for survival among smaller and mid-tier ransomware operators. Coveware’s insight that groups like Akira and Qilin are now targeting medium-sized firms reveals desperation, not dominance.

Yet, this isn’t the end of ransomware. Instead, it’s the beginning of its mutation. As profits shrink, attackers are focusing on precision targeting—leveraging AI-driven reconnaissance, spear-phishing, and insider collaboration. The new frontier of cybercrime will not be about encrypting data—it will be about manipulating trust.

Another critical observation lies in the changing attack vectors. Remote access breaches, often through misconfigured VPNs or outdated software, now top the list. Vulnerability exploitation is no longer limited to nation-state actors; it’s an industrialized, subscription-based economy on the dark web.

The parallel surge in password cracking—nearly doubling within a year—illustrates the persistent human factor in cyber risk. Organizations continue to underestimate credential management, even as threat actors automate brute-force and credential-stuffing campaigns.

In essence, the ransomware crisis is transforming into a broader data extortion ecosystem. The economics are shifting, the targets are changing, but the war is far from over. Companies that once treated cybersecurity as a cost are now realizing it is a core business survival strategy.

🔍 Fact Checker Results

✅ Coveware confirms that only 23% of ransomware victims paid in Q3 2025.
✅ Average ransom payments fell to $377,000, with a median of $140,000.
❌ No evidence supports the claim that ransomware groups are abandoning encryption entirely—most use both theft and encryption tactics.

📊 Prediction

💡 Expect a 15–20% decline in ransom profitability by mid-2026 as corporate defenses continue to mature.
🔐 Data extortion will outpace encryption as the dominant attack model.
🧠 Social engineering and insider recruitment will become the next major frontier in ransomware evolution.

🕵️‍📝✔️Let’s dive deep and fact‑check.

References:

Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI