Ransomware Payouts Plummet: A New Trend in Cybersecurity

There’s a fresh breeze in the cybersecurity air—ransomware payments have hit historic lows. Recent data from cybersecurity firm Coveware reveals that only 23% of ransomware victims paid their attackers in the third quarter of 2025, a record low. This decline continues a long-term trend, reflecting a shift in how businesses respond to these threats. Back in early 2024, 28% of victims paid up, but this number has gradually dwindled, suggesting a growing resistance to funding cybercriminals.

The average ransom payment has also taken a nosedive, dropping to $376,941, which is a 66% decrease from the previous quarter. Median payments are down to $140,000. Large businesses are increasingly refusing to pay, understanding that it doesn’t guarantee data security. Meanwhile, ransomware groups like Akira and Qilin are now targeting mid-sized companies, opting for smaller ransoms that these businesses find harder to refuse due to weaker defenses.

This trend represents a shift in the cybercrime economy, as companies focus more on preventative measures and collaboration with tech and law enforcement agencies to tackle these attacks. Despite sophisticated threats like automation and AI, these efforts are putting a dent in the effectiveness of cyber extortion.

Growing Resilience Among Businesses

According to Coveware, attacks focused purely on data exfiltration saw their payments drop to 19% in Q3 2025, even as such incidents increased. This suggests that businesses, with the help of legal and cybersecurity experts, are advising against ransoms, viewing them as a perpetuation of the extortion practice.

While larger corporations resist paying ransoms, mid-sized businesses remain vulnerable due to limited budgets. Groups like Akira and Qilin exploit this by opting for volume, preferring frequent low-value payments. This strategy highlights the need for these businesses to strengthen their defenses.

Not stopping there, cybercriminals continue using common entry methods like compromised remote access and phishing, honing in on lapses in credentials and software vulnerabilities. Most attacks in the last quarter could have been foiled with better security configurations and updated protocols.

Interestingly, the median company size targeted has grown to 362 employees, indicating a preference for larger targets without necessarily yielding bigger payouts. This shows a changing strategy in ransomware, where the bigger fish aren’t as financially rewarding as once thought, challenging assumptions about the financial windfall from targeting larger entities.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.