Ransomware Payments Hit Record Low as KillSec Takedown Lands

A teenager at the top of an extortion crew

On September 30, European police arrested three people tied to the KillSec ransomware group, seized its leak site and servers, and secured at least 110 TB of data. 1 The suspected administrator and main operator is a 16-year-old, detained in Alicante, Spain, by the Guardia Civil and the Mossos d'Esquadra. Officers also searched a home and a hotel office in the province. 1 Police and prosecutors in Hamburg, Germany, led the investigation. 1 The other two suspects, both in their 20s, were arrested in the U.K. and Romania. 1

The operation, called "Operation KillSwitch," involved 10 countries and private cybersecurity firms. Europol and the U.S. Justice Department announced it jointly. 2 Investigators say KillSec, run mostly by teenagers, compromised about 500 organizations since 2024. 2 One accused member, Fouad Eltibrizi, was arrested in the U.K. and is awaiting extradition to the United States. Authorities have not named the 16-year-old. 2

KillSec used the standard data-extortion model. It stole data, then threatened to publish it on its leak site unless victims paid. 1 What stands out is the age of its alleged leader. That fits a pattern investigators have raised before. Cybersecurity researchers have warned that young, native-English-speaking hackers in the U.S., U.K. and Canada are increasingly working with Russian ransomware operators. 5

More attacks, fewer checks

The takedown comes as the ransomware economy shows an odd split. Attackers are busier than ever but are getting paid less often. Data from Group-IB and Check Point Research shows attack volume rising quarter over quarter in the first half of 2026. Over the same period, the share of victims who pay has dropped to roughly 23%, a low neither firm had recorded before. 3 A September 9 compilation drew on four trackers, each measuring something different: leak-site posts, victim counts, negotiation caseloads and blockchain payment flows. All four pointed the same way. The gap between attacks and payments is now the widest since tracking began in 2019. 3

Blockchain analysis firm Chainalysis reported a similar trend for 2025, with a different number. Claimed attacks rose 50% that year, according to eCrime.ch figures. Yet the share of victims paying in cryptocurrency fell to 28.8%, down from 63.8% in 2024. The rate had been about 79% in 2022 and 72% in 2023. 4

The two headline figures, 28.8% and roughly 23%, are not a contradiction. They cover different periods and are measured differently. One comes from on-chain payment analysis for 2025. The other combines several trackers for 2026. Read together, they suggest the decline is continuing rather than reversing.

The money hasn't vanished

The trend is not as simple as "crime doesn't pay." Chainalysis found that while fewer victims paid in 2025, the median payment jumped 368% to nearly $60,000. 4 As a result, total ransomware revenue fell only 8%, to about $820 million, from an estimated $892 million in 2024. 4

In other words, attackers are getting paid less often but more per payment. One plausible reading is that gangs are casting wider nets and accepting more failures, while squeezing harder on the victims who do pay. Those victims are likely organizations without solid backups or with especially sensitive data.

Why victims are saying no

Chainalysis-linked analysis points to several causes: better incident response, more regulatory scrutiny, and effective international enforcement. It also notes a "marked fragmentation" among the big ransomware-as-a-service operations. 4

KillSec shows both the enforcement and fragmentation sides of that picture. A loosely run, youth-heavy crew that hit hundreds of targets in under two years is very different from the centralized cartels of a few years ago. Smaller, scattered groups may generate more leak-site posts and claimed attacks. But they may carry less credibility with victims, who have to trust that paying will actually lead to deleted data or working decryptors. Each seized leak site and arrest undermines that trust further.

The frontline damage is still real. Public bodies continue to be hit. A ransomware group claimed an attack on the Orleans Parish Sheriff's Office in 2025. LockBit previously disrupted a Georgia county's systems before local officials refused to give in. 5

The takeaway

The evidence supports a careful conclusion. Defenders and law enforcement are winning the argument over whether to pay, and that is starting to show in the economics. But rising attack counts and higher median ransoms mean the threat is changing shape, not shrinking. Operations like KillSwitch are important both for the arrests and for what they signal to would-be recruits, many of them teenagers, who see extortion as an easy payday. The next important data point is whether total revenue starts falling as quickly as the payment rate.