Why Ransomware Demands Are Being Ignored and What's Changed

A Drastic Decline in Ransom Payments

In recent years, the frequency of companies succumbing to ransomware demands has seen a sharp decline, with success rates plunging to a historic low of just 23%.

Cybersecurity firm Coveware, which monitors the movements of ransomware groups, reported that in 2019, around 85% of victims paid the ransom. But apart from a few quarterly increases, the trend has been downhill for cyber extortionists.

Their findings showed that 27% of affected businesses paid ransoms in the first quarter of 2025, which fell to 26% in the following quarter and further to 23% in the third quarter.

Focus on Data Theft

Instead of simply encrypting data to demand payment, criminals now focus primarily on stealing data, a method known as data exfiltration, which featured in 76% of ransomware incidents in Q3 2025.

Ransomware groups have realized that merely locking systems has limited impact, while possessing sensitive data increases the pressure on companies to comply with their demands.

Cybercriminals now often publicize their possession of stolen data by creating temporary websites or using other platforms to release samples. This increases pressure on organizations not only to pay but also to manage the fallout related to their reputations, potential legal issues, and the challenge of restoring systems.

Ransomware Industry Developments

The ransomware landscape has diverged into two key segments: those offering ransomware-as-a-service (RaaS) and those targeting specific victims with sophisticated attacks.

RaaS involves selling ransomware tools for a fee, focusing on high-volume attacks on mid-sized companies, while advanced groups target high-value enterprise systems with precision attacks.

Interestingly, the average ransom payment plummeted to $376,941, a drop of 66% from Q2 2025, with the median payment also decreasing significantly.

As major corporations increasingly stand firm against ransom demands, overall payments have decreased, although smaller companies may still be reluctantly paying to resume their operations, albeit less than before.

The Importance of Cybersecurity

Coveware predicts that, faced with diminishing profits, cybercriminals will intensify their efforts on obtaining ransom from large, financially capable businesses.

Today, robust cybersecurity measures are crucial, especially for mid-sized and larger firms, demanding investment in strong security frameworks and proactive measures such as penetration testing to expose vulnerabilities before they can be exploited.