Ransomware Payments Dropped in Q3 2025: Analysis

Ransomware payments dropped significantly in the third quarter of 2025, an analysis by Coveware shows, with the payment rate falling to a historical low of 23% as cyber extortion’s overall success rate contracts, according to Coveware. The average ransom payment in Q3 2025 was about $377,000, a 66% decrease from the previous quarter, while the median payment fell by 65% to $140,000.

Coveware attributes the decline to large enterprises increasingly refusing to pay and mid-market firms paying smaller ransoms, a trend reflected in comments that high-profile data exfiltration campaigns were largely unfruitful for attackers. Akira and Qilin were the most active ransomware groups in the quarter, a claim corroborated by ReliaQuest and ZeroFox reports, and all three security firms noted the professional services sector as the most targeted.

ReliaQuest also reported that data leak websites managed by cybercriminals reached a new high of 81 in Q3 2025, while ZeroFox recorded more than 1,429 ransomware and extortion incidents in Q3, up 5% from Q2.