Ransomware payments hit record low: only 23% Pay in Q3 2025

Only 23% of ransomware victims paid attackers in Q3 2025, the lowest rate recorded and continuing a six-year downward trend, according to Coveware. The average ransom payment dropped to $376,941 in Q3 2025, down 66% from Q2, while the median fell to $140,000, down 65%. Coveware notes that large firms are increasingly refusing to pay, with groups like Akira and Qilin targeting mid-sized firms with a high-volume, low-demand model.

Ransomware payments in data exfiltration-only attacks reached a record low of 19% in Q3 2025, despite a surge in such incidents. The report also highlights that attackers continued to exploit easy entry points, such as unpatched systems, exposed remote access, and stolen credentials, while prioritising scale over industry.

Experts view the drop in payments as progress, suggesting that fewer payments reduce attackers’ ability to monetise breaches, though automation and AI-driven methods may complicate efforts to eradicate cyber extortion entirely.