Ransomware Payment Rates Fall to 21% as Q3 2026 Attacks Peak

Record volume, shrinking payouts

The third quarter of 2026 brought two ransomware trends that seem to pull against each other. Attacks reached a new high, while the share of victims who paid a ransom fell sharply.

Comparitech's ransomware tracker recorded 2,627 attacks in Q3, close to 29 a day. That is up 29% from 2,030 in the second quarter and 61% from 1,636 in the same quarter of 2025 3. GuidePoint Security's Research and Intelligence Team (GRIT) also reported record victim volume for the quarter. It counted 112 active threat groups and said that number keeps growing 1.

On payments, GRIT found that the share of victims paying dropped from 50% to just under 21% in Q3 1. Those who did pay handed over more. The average payment rose 34%, from $240,000 to $321,000 1. GRIT's summary was that the "big game hunt" is still on, but far more groups are now taking part 1.

Where the numbers diverge

The payment figures depend on who is counting. Check Point, writing about the second quarter, put the payment rate at about 23%. It described a six-year slide from 85% in 2019 2. GRIT's 50% baseline for Q2 is much higher 1. The two firms likely use different samples and methods, so their percentages can't be compared directly. The direction is the same in both, though: most victims now refuse to pay.

A falling payment rate has not meant less money for attackers. Check Point notes that on-chain ransomware payments still exceeded $820 million in 2025 2. GRIT's higher average payment points the same way 1. Fewer victims are paying, but the ones who pay are paying more, so total revenue stays large enough to keep the industry running.

Why attackers are shifting to data theft

Check Point gives the clearest explanation for the payment decline. Organizations have improved their backups, which means encryption alone no longer forces a payment 2. Backups do nothing against stolen data. If files have already been copied out and the attacker threatens to publish them, restoring systems doesn't stop the leak. Check Point says operators are therefore putting exfiltration first and treating encryption as secondary 2.

This helps explain why attack counts can rise while payment rates fall. If each attempt is cheaper to launch and depends on stolen data rather than locked systems, running more campaigns makes sense even when fewer victims pay. Comparitech's numbers fit that pattern. Its tracker logged 4,217 attacks in the first half of 2026, 11% more than in the second half of 2025, before the Q3 jump 3.

The Gentlemen and smaller, faster crews

Both security vendors highlight one group. GRIT reports that The Gentlemen narrowly passed Qilin as the most active ransomware operation in Q3 1. Check Point's Q2 analysis of leaked chats from the group shows how small it is. A core team of about nine people, using AI coding tools, built one of the top three operations worldwide in a matter of months 2.

Taken together, this suggests the barrier to entry has dropped. If a small crew with AI help can reach the top tier, a growing number of groups is what you would expect. That matches GRIT's count of 112 1 and Check Point's description of a threat that "spread out" rather than slowed 2.

Which sectors and regions are hit

GRIT says manufacturing is still the most affected industry and that targeting is spreading across more countries 1. Its Q3 report also focuses on education, the ShinyHunters group, recent activity from the Clop syndicate, and what it calls a "vulnpocalypse" of exploitable flaws 1. Comparitech's retail breakdown shows the same rise. It recorded 199 attacks on retailers in Q3, up from 154 the quarter before and nearly double the 101 seen a year earlier 3.

What it means for defenders

The main takeaway is that a lower payment rate does not mean the threat is shrinking. It shows that victims have gotten better at recovering from encryption. Attackers have responded by stealing data, running more attacks, and charging the remaining payers more.

Check Point's advice is to give initial access, data exfiltration, and overall exposure the same priority, instead of relying mainly on backups 2. Backups are still necessary because they are a big reason payment rates have fallen. They don't protect against a leak threat, which is now the attackers' main source of leverage.

The Q3 2026 figures show more attacks, more groups, and higher payments from those who pay. Organizations that measure their risk only by the falling payment rate are likely to underestimate it.