Ransomware Payment Rates Fall to 23% as Q3 Attacks Hit Record

Record attacks, shrinking payouts

Ransomware gangs have never been busier, and they have rarely been paid less often. The third quarter of 2026 set a new high for recorded attacks. Comparitech's tracker logged 2,627 incidents, close to 29 a day. That is up 29% from 2,030 in the second quarter and 61% above the 1,636 recorded in Q3 2025 5. The first half of the year had already run ahead of late 2025, with 4,217 attacks against 3,809 in the prior six months, an 11% rise 5.

Victims, however, are increasingly refusing to pay. Check Point Research's Q2 2026 data put the ransom payment rate near 23%. It describes that figure as a multi-year low and the latest step in a six-year slide from roughly 85% in 2019 2. Separate coverage pulling together Check Point, Group-IB and other trackers describes the gap between attack volume and payment rates as the widest since researchers began tracking payment behavior in 2019 1.

Where the numbers agree, and where they don't

The broad direction is consistent: more attacks and fewer payers. The details vary widely depending on who is counting and how.

Attack tallies differ by method. Group-IB counted 2,393 leak-site attacks across 79 groups in Q1 2026 and 2,202 victims across 92 groups in Q2 2. Check Point logged 2,122 new victims on more than 70 leak sites in Q1 2. Comparitech's Q2 figure of 2,030 is lower still 5. Leak-site posts, confirmed victims and tracker logs measure different things, so these figures shouldn't be read as contradictions. Each one covers a different slice of a market that is opaque by design 1.

Payment figures diverge more. Sophos's 2026 survey found that 48% of victims whose data was encrypted paid, which is about double Check Point's rate 2. Verizon's 2025 Data Breach Investigations Report found 64% of victims refused to pay, up from 50% two years earlier 3. That implies a payment share in the mid-30s. The likely explanation is the denominator. Counting only encrypted organizations, or only survey respondents, produces a different number than counting every victim named on a leak site.

Ransom sizes are just as inconsistent. Chainalysis put the 2025 median payment at $59,556, up 368% year over year 2. Another compilation cites a 2025 median of $115,000 and frames it as a decline 3. Sophos's 2026 survey median is $769,000 2. GuidePoint's research group puts average demands for two leading groups at $366,000 to $457,000 2. One reasonable reading is that fewer organizations pay, but the ones that do pay more, which matches the "bigger checks" framing in some coverage 2.

Why attackers keep scaling up

If payments are drying up, why are attacks surging? Part of the answer is volume as compensation. When fewer victims pay, hitting more targets keeps revenue flowing. Group-IB's count of active leak-site groups rose from 79 to 92 between Q1 and Q2 2. That suggests more crews are competing for a shrinking pool of willing payers.

Easy entry points help too. Coverage of the Q3 record links the surge to zero-day exploitation 5. On September 30, Palo Alto Networks' Unit 42 published a threat brief on NetScaler flaws CVE-2026-88771 and CVE-2026-88772. Citrix confirmed both had been exploited in the wild, and the brief references remote code execution and denial-of-service risks 4. The available reporting does not tie these specific bugs to particular Q3 ransomware incidents. Still, edge-device vulnerabilities like these are a well-known first step for intrusions.

Some sectors are getting hit harder than the average. Retail saw 199 attacks in Q3, up 29% from the prior quarter and nearly double the 101 recorded a year earlier 5. Manufacturing remains the most targeted sector by volume at 14% 3. Smaller firms are especially exposed: ransomware appears in 88% of SMB breaches, compared with 39% at large organizations 3. The United States accounts for an estimated 55% of global attacks 3.

The takeaway

The falling payment rate is real progress. Better backups, faster recovery and growing reluctance to fund criminals are weakening the business model. One compilation notes recovery times dropped by nearly half 3. But a lower payment rate does not mean less harm. Each of those 2,627 Q3 attacks still disrupted a business, whether or not money changed hands.

The pattern now looks like a war of attrition. Defenders are making extortion less reliable, and attackers are answering with scale, more groups and fresh exploits. Until edge-device patching keeps pace with zero-day exploitation, record attack counts and record-low payment rates are likely to keep rising and falling together.