<h1>Ransomware Payments Decline Amid Surge in Attacks in 2025</h1>
In 2025, ransomware payments experienced a significant decline, even as the number of attacks surged to record levels. According to a Chainalysis report, the total ransomware payments amounted to $820 million, marking a 28% decrease from the previous year. This decline in payments occurred despite a staggering 50% increase in the number of ransomware attacks.
Several factors contributed to the decline in ransomware payments. Primarily, more organizations adhered to recommended practices of not paying ransoms. This approach discourages attackers by reducing the financial incentive for carrying out further attacks and mitigates potential legal consequences associated with making payments to sanctioned groups.
Interestingly, while fewer victims opted to pay, those who did ended up paying significantly larger amounts. The average ransom payment skyrocketed by 368% year-over-year, reaching nearly $60,000. This trend suggests that victims willing to pay were driven by the hope that attackers would delete their stolen data rather than sell it or leak it to the public.
The ransomware landscape in 2025 also saw increased fragmentation following the splintering of major groups like LockBit and BlackCat. This change made way for smaller, opportunistic crews to carry out attacks, with initial access brokers playing a significant role. These brokers received payments totaling at least $14 million and often preceded ransomware attacks by around 30 days.
Despite the overall decline in ransom payments, the geography of attacks remained largely the same, with the US, Canada, Germany, and the UK continuing to be primary targets. Notably, every major sector in the US saw an increased number of victims, highlighting the persistent threat that ransomware poses across various industries.

Collections

Ransomware payments dropped 28% to $820 million in 2025 despite a 50% surge in attack volume, according to Chainalysis. More organizations refused to pay ransoms, reducing financial incentives for attackers. However, those who did pay saw average payments jump 368% year-over-year to nearly $60,000, often hoping attackers would delete stolen data. The landscape fragmented after LockBit and BlackCat broke apart, enabling smaller opportunistic groups. Initial access brokers received at least $14 million and typically preceded attacks by ~30 days. The US, Canada, Germany, and UK remained primary targets, with every major US sector seeing increased victims.