Ransom Payments Often Trigger Repeat Extortion, Study Finds

A significant number of organizations that pay ransomware attackers are subsequently targeted again, according to a new industry report that reinforces long-standing warnings against meeting extortion demands. The 2026 AI-Era Ransomware Report from cybersecurity firm Proofpoint, based on a global survey of 953 security professionals, found that 54% of affected organizations paid their attackers. Among those who paid, 37% faced a repeat extortion demand from the same or affiliated criminals.

The data indicates that a single ransom payment frequently fails to end the threat. Beyond the risk of repeat demands, the report notes that 2% of paying victims never regained access to their encrypted files at all. These findings underscore the evolving nature of ransomware, where attacks have shifted from a one-time transaction to sustained campaigns using multiple forms of leverage, such as retaining stolen data under the threat of public release.

Experts and government agencies, including the UK's National Cyber Security Centre, have consistently advised against paying ransoms, arguing that it funds criminal operations and encourages further attacks. The new data provides empirical...