Ransomware Payment Rates Hit Record Lows as Data Theft Soars

The Divergence at the Heart of Ransomware

The ransomware economy has developed a split personality. Attack volumes and data theft are climbing to record levels, yet the share of victims willing to pay has sunk to multi-year lows. Several independent trackers now show this pattern, with only minor differences in the details. The shared message is that a falling payment rate should not be read as a weakening threat.

Fewer Victims Are Paying

The clearest trend is the long decline in payment rates. Check Point's Q2 2026 research puts the rate near 23%, the end of a six-year slide from 85% in 2019 1. Coveware's incident-response data showed roughly 23% of victims paying in Q3 2025 and about 20% in Q4 2025, levels described as unprecedented 12. Chainalysis, which works from blockchain data, estimates that 28% of victims paid in 2025 2.

GuidePoint Security's GRIT team reports the sharpest short-term drop. In its Q3 2026 data, the payment rate fell from 50% to just under 21% 3. The trackers use different methods, including incident-response caseloads, on-chain analysis and leak-site monitoring. That they land in the same low-20s range makes the trend hard to dismiss.

The money follows the same direction. Chainalysis tracked about $820 million in on-chain ransomware payments in 2025, down 8% from a revised $892 million in 2024 and the lowest full-year total since 2021 2. Zscaler's ThreatLabz counted $328 million in blockchain-linked ransom payments between April 2025 and March 2026 4. That figure is much lower than Chainalysis's, which likely reflects different time windows and attribution methods rather than a contradiction.

More Attacks, Not Fewer

Attack volume is moving the other way. Leak sites recorded a record 7,874 claimed victims in 2025, so attackers are hitting more targets to collect less money overall 2. GRIT says victim volume reached another record in Q3 2026 and that the number of active threat groups keeps growing 3. It also found that a group called TheGentlemen narrowly passed Qilin as the most active operation 3. Manufacturing remains the most heavily hit sector, and targeting is spreading to more countries 3.

Zscaler adds the AI angle. Its 2026 report says data stolen in ransomware incidents rose more than 275% year over year, reaching 896.2 terabytes 4. Some summaries apply the 275% figure to ransomware activity overall rather than to data volume, so the narrower reading is the safer one. Zscaler describes generative AI as an accelerator of existing techniques, not a replacement for them. In its framing, AI helps attackers move faster as operations shift from encryption toward large-scale data theft 4.

The Size of Ransoms Depends on Who's Counting

The trackers disagree most on ransom size. Several show that the victims who still pay are paying more. GRIT found the average payment rose 34%, from $240,000 to $321,000 3. Chainalysis reported the median on-chain ransom jumped 368% to $59,556 2. Zscaler recorded a 5.3% rise in the average payment 4.

Sophos points the other way. Its State of Ransomware 2025 puts the median paid ransom at $1.0 million, down from $1.26 million a year earlier 2. The difference probably comes from sampling. Sophos surveys organizations large enough to commission incident response, while on-chain data captures many smaller payments. One analysis argues that ransomware is shifting from a volume business toward targeted extraction aimed at organizations least able to refuse 1. GRIT offers a broader picture: big-game hunting continues, but many newer groups are content with smaller payouts 3.

Mass Exploitation Is Faltering

GRIT also reports that Clop, once known for mass-exploitation campaigns, has stalled. GRIT found no ransom payments tied to Clop's PTC Windchill campaign, and its leak-site victim count is far below earlier efforts 3. This suggests the spray-and-pray model of exploiting one vulnerability across many organizations is producing weaker returns.

What It Adds Up To

The most reasonable conclusion is that defenders are winning on one metric while losing ground on others. Better backups, firmer no-pay policies and growing awareness that paying does not guarantee data deletion seem to be pushing payment rates down. Attackers are responding with more operators, more targets, broader geographic reach and AI-accelerated theft of data that can be leaked or reused even when no one pays.

For security leaders, the falling payment rate is real progress, but it says little about exposure. Data stolen in an attack is still lost whether or not the victim pays, and the volume of stolen data is rising quickly. GRIT puts it directly: a declining payment rate is not a declining threat 3.