FinCEN Report: Reported Ransomware Incidents and Payments Reached All-Time High in 2023

According to FinCEN, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network, its Financial Trend Analysis on ransomware incidents in Bank Secrecy Act data shows a record level in 2023, with 1,512 incidents and $1.1 billion in payments. The annual total declined in 2024 to 1,476 incidents and $734 million in reported payments, following law enforcement disruption of two high-profile groups.

Over the three-year period from January 2022 to December 2024, FinCEN received 7,395 BSA reports related to 4,194 ransomware incidents totaling more than $2.1 billion in payments. Industry-wise, financial services recorded 432 incidents with about $365.6 million, manufacturing 456 incidents with around $284.6 million, and healthcare 389 incidents with roughly $305.4 million in reported payments.

The Onion Router (TOR) was the most common communication method reported, used in 67 percent of reports that specified a method, with other actors using email or private encrypted messaging. The most reported ransomware variants between 2022 and 2024 included Akira, ALPHV/BlackCat, LockBit, Phobos, and Black Basta, accounting for the top payments.