Keypoints
- Victim payment rate fell to 28% in 2025 despite a roughly 50% increase in claimed ransomware attacks.
- On-chain ransomware payments reached about $820 million and may approach or exceed $900 million as more events are attributed.
- The median ransom payment rose 368% to $59,556, indicating fewer victims are paying but for larger amounts.
- The ecosystem fragmented to 85 active extortion groups, with high-impact incidents such as Jaguar Land Rover and Marks & Spencer.
- Initial access brokers and falling access prices are reshaping attack dynamics, with IAB inflows often preceding ransomware payments by about 30 days.