Only 23% paid extortion demands in Q3 2025, ransomware payments fall

Only 23 percent of organizations hit by ransomware in the third quarter of 2025 paid extortion demands, a historic low that reflects a shrinking return for attackers even as incident volume remains elevated, cybersecurity firm Coveware reported. The company said average ransom payments fell about 66 percent from the prior quarter to roughly $377,000, while the median payment dropped about 65 percent to $140,000.

Coveware and other security firms said the decline in payment rates continues a multi-year trend. The firm found that payment rates fell to 23 percent across encryption, data-exfiltration, and other extortion scenarios, and to 19 percent for incidents that involved data theft without encryption. Analysts attribute the shift to a mix of stronger defensive measures, growing legal and law enforcement pressure against paying ransoms, and changes in attacker strategy.

Large enterprises appear increasingly unwilling to pay, even after high-profile data-exfiltration campaigns, prompting threat actors to alter their targets and tactics. Coveware reported that groups employing a high-volume, low-demand model, including Akira and Qilin, focused more on midmarket firms that are...