--- title: Ransomware Payments Decline Amid Surge in Attacks in 2025 description: Ransomware payments dropped 28% to $820 million in 2025 despite a 50% surge in attack volume, according to Chainalysis. More organizations refused to pay... canonical: https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ransomware Payments Decline Amid Surge in Attacks in 2025 | daily.dev og:description: Ransomware payments dropped 28% to $820 million in 2025 despite a 50% surge in attack volume, according to Chainalysis. More organizations refused to pay... og:url: https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3 og:image: https://api.daily.dev/og/posts/dJUNepaG3.png og:image:alt: Ransomware Payments Decline Amid Surge in Attacks in 2025 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ransomware Payments Decline Amid Surge in Attacks in 2025 **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Ransomware payments dropped 28% to $820 million in 2025 despite a 50% surge in attack volume, according to Chainalysis. More organizations refused to pay ransoms, reducing financial incentives for attackers. However, those who did pay saw average payments jump 368% year-over-year to nearly $60,000, often hoping attackers would delete stolen data. The landscape fragmented after LockBit and BlackCat broke apart, enabling smaller opportunistic groups. Initial access brokers received at least $14 million and typically preceded attacks by ~30 days. The US, Canada, Germany, and UK remained primary targets, with every major US sector seeing increased victims. ## Content # Ransomware Payments Decline Amid Surge in Attacks in 2025 In 2025, ransomware payments experienced a significant decline, even as the number of attacks surged to record levels. According to a Chainalysis report, the total ransomware payments amounted to $820 million, marking a 28% decrease from the previous year. This decline in payments occurred despite a staggering 50% increase in the number of ransomware attacks. Several factors contributed to the decline in ransomware payments. Primarily, more organizations adhered to recommended practices of not paying ransoms. This approach discourages attackers by reducing the financial incentive for carrying out further attacks and mitigates potential legal consequences associated with making payments to sanctioned groups. Interestingly, while fewer victims opted to pay, those who did ended up paying significantly larger amounts. The average ransom payment skyrocketed by 368% year-over-year, reaching nearly $60,000. This trend suggests that victims willing to pay were driven by the hope that attackers would delete their stolen data rather than sell it or leak it to the public. The ransomware landscape in 2025 also saw increased fragmentation following the splintering of major groups like LockBit and BlackCat. This change made way for smaller, opportunistic crews to carry out attacks, with initial access brokers playing a significant role. These brokers received payments totaling at least $14 million and often preceded ransomware attacks by around 30 days. Despite the overall decline in ransom payments, the geography of attacks remained largely the same, with the US, Canada, Germany, and the UK continuing to be primary targets. Notably, every major sector in the US saw an increased number of victims, highlighting the persistent threat that ransomware poses across various industries. ## Similar posts on daily.dev - [Report: Profits from ransomware attacks declining](https://daily.dev/posts/report-profits-from-ransomware-attacks-declining-6piizddam) · CSO Online · 0 upvotes · 0 comments - [The State of Ransomware Q2 2026](https://daily.dev/posts/the-state-of-ransomware-q2-2026-cwgxqmj2p) · Check Point Research · 0 upvotes · 0 comments - [If you pay a hacker’s ransom, chances are that they’ll come back for more](https://daily.dev/posts/if-you-pay-a-hacker-s-ransom-chances-are-that-they-ll-come-back-for-more-s5y67i6nt) · TechCrunch · 0 upvotes · 0 comments - [Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report](https://daily.dev/posts/ransomware-leverage-is-growing-by-the-terabyte-takeaways-from-threatlabz-2026-ransomware-report-12cyw5vjm) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ransomware](https://daily.dev/tags/ransomware), [#lockbit](https://daily.dev/tags/lockbit) [View this post on daily.dev](https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ransomware Payments Decline Amid Surge in Attacks in 2025","url":"https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3"},"datePublished":"2026-03-02T08:37:32.672Z","dateModified":"2026-03-02T08:37:59.530Z","description":"Ransomware payments dropped 28% to $820 million in 2025 despite a 50% surge in attack volume, according to Chainalysis. More organizations refused to pay...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cebf7886d1e33f126b755014d8c30806?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cebf7886d1e33f126b755014d8c30806?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ransomware-payments-decline-amid-surge-in-attacks-in-2025-djunepag3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ransomware,lockbit","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Ransomware Payments Decline Amid Surge in Attacks in 2025"}]} ```