- A report claims that only 23% of ransomware victims paid attackers in the third quarter of 2025, an all-time high.
- Average ransom payment fell 66% to $376,941; the median fell 65% to $140,000
- Data-only exfiltration attacks saw only 19% of victims pay a ransom
The number of companies paying ransomware attackers to obtain decryption keys and delete stolen files has plummeted and now accounts for just 23% of all victims, according to a new study.
In its report, Coveware said ransom payment rates across all impact scenarios – encryption, data exfiltration and other extortion – fell to an “all-time low” of 23% in the third quarter of 2025.
This continued long-term downward trend is something everyone in the industry should take a moment to think about: the overall success rate of cyber extortion is declining,” the company said.
Data-only attacks also work poorly
This isn’t the only metric that’s down significantly. The average ransom payment now stands at $376,941, which is a two-thirds (66%) decrease from the second quarter of 2025. The median ransom payment now stands at $140,000, which is also down 65% from the second quarter of the year.
Originally, the idea of the ransomware was to simply encrypt files and then demand money in exchange for the decryption key. However, when companies began implementing backups, hackers began stealing files and threatening to release them across the Internet – a tactic now commonly referred to as “double extortion.”
Meanwhile, creating and maintaining ransomware variants has become expensive, forcing many ransomware actors to abandon the encryption part altogether and focus exclusively on data exfiltration. ShinyHunters is a brilliant example (pun very much intended).
But Coveware says even this tactic isn’t effective, because for incidents related to data exfiltration alone, ransom payments fell to 19% in the third quarter of 2025, which is “another all-time high.”
“Even though this resolution rate tends to rebound, the third quarter was a very active quarter in terms of data exfiltration attacks,” the researchers point out.
“Cyber defenders, law enforcement, and legal scholars should view this as validation of collective progress,” Coveware says. “The work done to prevent attacks, minimize their impact and successfully deal with cyber extortion – every payment avoided restricts the oxygen of cyber attackers. »
Via BeepComputer
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
