Ransomware Payments Hit Record Lows as Data Theft Soars

Fewer checks, bigger stakes

The ransomware economy now shows a clear contradiction. Attacks keep rising, but victims are paying less often than at any point researchers have tracked. Data from several independent trackers points the same way: criminals are striking more, collecting from fewer targets, and changing tactics to make up the difference.

The sharpest number comes from Group-IB and Check Point Research. Their 2026 figures show attack volume climbing quarter over quarter in the first half of the year, while the share of victims who pay has fallen to roughly 23%, a level neither firm had recorded before 1. A September 2026 compilation drew on four trackers, each measuring a different part of the ecosystem: leak-site posts, victim counts, negotiation caseloads and blockchain payment flows. All four pointed in the same direction, and the gap between attacks and payments is the widest since payment tracking began in 2019 1.

Blockchain analysis firm Chainalysis reports a slightly higher payment rate for 2025, at about 28%, or 28.8% in one account 24. That is still the lowest in its series. The decline has been steep: 78.9% in 2022, 72.2% in 2023 and 63.8% in 2024 4. Claimed attacks rose 50% over the same period, according to eCrime.ch data cited in that analysis 4.

Why the totals don't match

The figures diverge, and the reason matters. The 23% and 28% rates come from different datasets and cover different periods. Chainalysis tracks on-chain cryptocurrency flows for 2025, while the lower figure blends negotiation and incident data from 2026 12. Revenue totals also differ by tracker. Chainalysis puts 2025 ransomware revenue at about $820 million, down 8% from an estimated $892 million in 2024 4. Zscaler ThreatLabz counts known payments of $327.8 million, down 15.8% year over year, with the number of individual payments down 20.1% 3.

These numbers can't be reconciled exactly, and readers should be careful with any single headline figure. The direction is consistent, though: payment rates are falling and aggregate revenue is slipping.

The revenue decline is also smaller than the drop in payment rates would suggest. Chainalysis found median payments rose 368% to nearly $60,000 4. Attackers appear to be squeezing harder on the victims who still pay, which keeps total income from collapsing 2.

Stolen data replaces encryption

The biggest strategic shift appears in Zscaler's figures. Ransomware-linked data theft jumped 275%, more than seven times the volume seen two reporting cycles earlier, even as payments fell 3. The likely explanation is that operators now treat stolen data, rather than encrypted systems, as their main source of leverage 3. Backups can undo encryption. They cannot undo the public release of patient records or student files.

Public-sector targets have taken some of the heaviest losses. Schools, hospitals and government agencies were among the largest claims, and one group reportedly took 30 terabytes from a single government target 3. Recent cases fit the pattern. A ransomware group claimed an attack on the Orleans Parish Sheriff's Office in 2025, and LockBit temporarily crippled a Georgia county's online systems before officials refused to give in 5.

A more crowded, fragmented field

The criminal ecosystem is also changing shape. Chainalysis counted 85 active extortion groups in 2025, far more than in years when a few large operations dominated 2. Observers describe a marked fragmentation of major ransomware-as-a-service operations, driven partly by international law-enforcement action 4. Other factors cited for falling payments include better incident response and closer regulatory scrutiny 4.

Fragmentation doesn't necessarily mean less danger. Investigators have warned that young, native-English-speaking hackers in the U.S., U.K. and Canada are teaming up with Russian groups, a mix that could make attacks more effective and harder to predict 5.

The takeaway

In my view, the data does not show ransomware losing ground. It shows ransomware adapting. Lower payment rates suggest that preparation, backups and refusal policies work, and that law-enforcement pressure is breaking up the big cartels. But a 275% rise in data theft means the threat has moved rather than shrunk. For defenders, restoring systems is no longer enough. Data exfiltration is now the main thing to monitor and prevent, because it is the leverage attackers are betting on.