Ransomware Payment Statistics 2026: Fewer Victims Pay, Some Pay More
CyberReviewed Research Desk ·
When criminals hit a US company with ransomware, they lock its systems and often copy its files as well, then demand payment to unlock the systems and keep the files private. Ransomware complaints to the FBI have risen every year since 2022. At the same time, more victims refuse to pay, and police have taken down some of the largest gangs.
So we looked at whether fewer payments mean less money reaching the attackers.
Our analysts compared four sources. Chainalysis traces ransomware payments on public blockchains and estimates yearly totals and median payments. Coveware, an incident response firm owned by Veeam, reports how often its clients pay and how much. Verizon's 2026 Data Breach Investigations Report and the FBI's Internet Crime Complaint Center add breach and complaint data.
In the following sections, we look at total payments, the share of victims who pay, the widening gap between average and median payments, who is being targeted and what the FBI's complaint data shows.
Total ransomware payments are falling
Chainalysis, which traces cryptocurrency flowing to ransomware wallets, estimates victims paid $820 million in 2025, down 8% from a revised $892 million in 2024 and well below the $1.25 billion recorded in 2023.12 The decline came even as claimed attacks on leak sites rose 50%, according to the same analysis, and Chainalysis estimates that 28% of victims paid.1
- Payments traced on chain fell $430 million from 2023 to 2025, a drop of about 34%.
- Payments fell in 2025 even though claimed attacks on leak sites rose 50%.
- Chainalysis estimates that 28% of victims paid in 2025. A company that is hit is now far more likely to be among the victims who refuse.
The share of victims who pay keeps dropping
Coveware, the incident response firm now part of Veeam, reports the share of its ransomware and extortion cases that end in a payment. That rate fell from 26% in Q2 2025 to 19% in Q2 2026, the lowest in the series, and for attacks where criminals only stole data without encrypting it, the rate was 15%.3
| Quarter | Payment rate |
|---|---|
| Q1 2024 | 28% |
| Q2 2024 | 36% |
| Q3 2024 | 32% |
| Q4 2024 | 25% |
| Q1 2025 | 27% |
| Q2 2025 | 26% |
| Q3 2025 | 23% |
| Q4 2025 | 20% |
| Q1 2026 | 23% |
| Q2 2026 | 19% |
- The highest rate in the series was 36% in Q2 2024. By Q2 2026 it was roughly half that.
- The decline was not steady. The rate rose from 20% in Q4 2025 to 23% in Q1 2026 before falling again.
- More than four in five of Coveware's Q2 2026 cases ended without a payment. Refusing to pay is now the usual outcome among its clients.
Verizon's 2026 Data Breach Investigations Report points the same way: 69% of ransomware victims in its data did not pay.4
The average payment and the median are moving apart
In Q2 2026, the average payment in Coveware's cases rose 176% to $1,880,612, while the median payment fell 50% to $150,000.3 Coveware attributes the jump mainly to a few large payments for stolen data, including a campaign against law firms by a group known as Silent Ransom.3 When the average climbs and the median falls, a small number of large victims are paying very large sums while most payers are settling for less. Chainalysis saw the median payment in 2025 rise to $59,556 from $12,738, and Verizon reported a median ransom of $139,875, down from $150,000 in its previous report.14
| Measure | Latest figure | Change | Source |
|---|---|---|---|
| Average payment | $1,880,612 (Q2 2026) | Up 176% | Coveware |
| Median payment | $150,000 (Q2 2026) | Down 50% | Coveware |
| Median payment, traced on chain | $59,556 (2025) | Up from $12,738 in 2024 | Chainalysis |
| Median ransom paid | $139,875 | Down from $150,000 | Verizon DBIR 2026 |
- Coveware's Q2 2026 average was more than 12 times its median.
- The three medians range from $59,556 to $150,000. Chainalysis counts small on-chain payments that incident response firms may never see.
- A median is a better guide to a typical payment than the average. A few large data-theft payments pushed Coveware's Q2 2026 average up.
The sources measure different things. Coveware counts the cases it handles, which skew toward organizations large enough to hire an incident response firm. Chainalysis sees every payment it can trace on chain, including small ones. Verizon's figure reflects the breaches in its dataset. All three show fewer victims paying, and Coveware's figures show the largest payments concentrated among a few victims whose stolen data was at stake.
Who is being targeted
Most victims in Coveware's Q2 2026 cases were mid-size organizations. Those with 11 to 10,000 employees made up 75.8% of victims, and the median victim had 750 employees.3 Verizon found ransomware in 48% of the breaches it analyzed, up from 44%, and IBM's 2026 study found that 39% of breached organizations were hit by ransomware, up from 24% in 2023.46
What the FBI sees
Ransomware complaints to the FBI's Internet Crime Complaint Center rose every year from 2022 through 2025, reaching 3,611, and the FBI identified 63 new ransomware variants in 2025.5 Reported losses were $32.3 million in 2025, but IC3 notes that the figure excludes lost business, time, wages, files, equipment and third-party remediation, and that some victims report no loss amount, so the figure is a minimum.5
- Complaints reached 3,611 in 2025 after rising every year since 2022.
- Reported losses of $32.3 million work out to about $8,900 per complaint. IC3's figure leaves out downtime, recovery and many unreported amounts, which is why it sits far below Coveware's $150,000 median payment.
- FBI complaints and Verizon's ransomware share both rose while payments fell, so a US company's exposure to an attack has not fallen.
What the figures mean for companies that are hit
For most companies hit by ransomware, refusing to pay is now the usual choice. That leaves restoring systems from backups as the way most of them get running again.
The largest payments that still happen are often made to keep stolen data from being published, as in the law firm cases behind Coveware's Q2 2026 average.
So if your company has not tested restoring its systems from backups, that test matters more for a ransomware event than the size of any payment budget.
Sources
Methodology
Annual totals and median payments come from Chainalysis's 2025 and 2026 ransomware analyses; the 2024 total is the revised figure published in 2026. Quarterly payment rates and Q2 2026 average and median payments come from Coveware by Veeam's quarterly reports and its Q2 2026 white paper. Verizon figures come from the 2026 Data Breach Investigations Report. IBM's ransomware share comes from its Cost of a Data Breach 2026 study. FBI complaint counts and losses come from the IC3 annual reports for 2024 and 2025. Each source uses a different sample, so figures are compared for direction, not combined. All money is in US dollars.