Ransomware Payment Rates Fall to 23% as Attack Volumes Climb

Ransomware gangs are attacking more often than ever, and fewer victims are paying them. Across several 2026 datasets, the share of victims who pay has dropped to about 23%, the lowest level these researchers have recorded. Attack volume kept rising quarter after quarter through the first half of the year 34. The result is a sharper split between criminal activity and criminal revenue than the industry has seen before. The money is now concentrated in a smaller group of high-value victims.

The numbers behind the split

Check Point's Q2 2026 research puts ransom payment rates near 23%, which it describes as a multi-year low and the latest step in a six-year decline from 85% in 2019 4. Group-IB's data shows the same pattern: attack volume up and willingness to pay down 3.

The baseline is reported inconsistently. Some accounts put the starting point at 77% rather than 85% 3. The direction does not change either way. Over roughly six years, paying went from what most victims did to what fewer than one in four do.

Blockchain data gives the most concrete evidence that attack counts and attacker income have separated. Chainalysis found that total on-chain ransomware payments fell about 8% in 2025, to roughly $820 million. That happened even though claimed attacks rose 50% 2. It was the second straight annual decline, down from a revised $892 million in 2024 4.

The Chainalysis revenue figures cover 2025, while the 23% payment rate describes 2026. The two datasets show the same trend over different periods, not the same period measured two ways.

Fewer payers, bigger checks

The most notable data point is the median payment. Chainalysis reports it rose 368% in one year, from $12,738 in 2024 to about $59,556 in 2025 24. This does not mean ransomware got more profitable overall, since total revenue fell 4. A more plausible reading is that payouts are concentrating. Many smaller victims now refuse or recover without paying. The organizations that still pay tend to be larger, more desperate, or less prepared, so they pay more.

For finance and insurance teams, that changes how to think about risk. Falling aggregate revenue does not lower the cost for any single organization. A company that ends up in the paying minority may face a much larger demand than it would have a few years ago.

A market, not a series of break-ins

Chainalysis describes ransomware as a connected marketplace of access, infrastructure, and monetization services rather than a set of isolated attacks 2. Two findings support that view:

• Access brokers predict attacks. Spikes in money flowing to initial access brokers usually come about 30 days before increases in ransomware payments and leak-site postings. That gives defenders a possible early warning 2.
• Criminal and state actors share infrastructure. Financially motivated groups and state-aligned actors use the same bulletproof hosting providers and residential proxy networks to avoid detection 2.

Warlock shows the threat hasn't softened

Current incidents show that lower payment rates have not reduced attackers' reach. Symantec's Threat Hunter Team reported on October 1, 2026, that a suspected China-linked crew called Warlock had compromised at least four organizations over two months, including a water utility and a telecom provider. It got in through unpatched Microsoft SharePoint servers 1. Some of the flaws it exploited, the "ToolShell" vulnerabilities, were patched in July 2025. CISA warned about newer SharePoint bugs in a July 2026 advisory 1.

Warlock is also tracked as Gold Salem, Longlegs, and Storm-2603. It has hit critical infrastructure, government, and education targets in Portuguese- and Spanish-speaking countries, and it disables security tools before deploying ransomware 5. The China attribution is Symantec's assessment, not a government finding 1.

Researchers also warn that patching alone is not enough. Stolen SharePoint machine keys keep working after updates unless administrators rotate them 1.

The wider threat landscape is moving in a similar direction. Microsoft documented a group called JADEPUFFER (tracked as Storm-3168) using compromised service principals during an 18-hour operation in June 2026. The group deleted Azure storage accounts, databases, key vaults, virtual machines, and recovery protection locks 5. When the goal is disruption rather than payment, a victim's refusal to pay protects very little.

The takeaway

The 23% figure is good news, and it likely reflects better backups, tighter incident response, and more organizations refusing to pay on principle. But it should not lead anyone to relax. Attackers are compensating with volume and aiming for fewer, larger payouts. They rely on old, unpatched vulnerabilities and on access markets that work like supply chains.

In practice, ransomware is becoming less profitable for criminals as a group but not less dangerous for individual organizations. Two measures will matter most for defenders:

• Basic hygiene. That means patching promptly and rotating credentials and keys after updates.
• Early warning. Monitoring signals such as access-broker activity can give roughly a month's notice before attacks rise.