53% of companies that paid the ransom successfully negotiated a lower amount than the initial demand.

The median ransom demand decreased by a third between 2024 and 2025.

The median ransom payment dropped by 50% from $2 million in 2024 to $1 million in 2025.

In 71% of cases where companies paid a smaller ransom than the initial demand, negotiation played a role, either directly or with third-party assistance.

Organisations with $250 million revenue or less saw median ransom demands of less than $350,000.

Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.

Ransom payment values declined by 35%.

The Black Basta variant had the highest average ransom demand at $4 million.

The average ransom demand in 2024 was $1.1 million.

44% of cyber insurance policyholders that experienced a ransomware incident opted to pay the ransom when deemed reasonable and necessary.

Ransom demands from threat actors decreased by 22% year-over-year (YoY) in 2024.

The average ransom demand in the latter half of 2024 fell below $1 million for the first time in more than two years.

Of organizations that paid a ransom, 60% paid less than half of the initial ransom.

There was a noticeable decrease in the median ransom amount paid.

64% of victim organisations did not pay ransoms this year, compared to 50% two years ago.

The total value of ransomware payments fell in 2024.

36% of organizations affected by ransomware opted not to pay a ransom.

Of organizations that paid a ransom, 82% paid less than the initial ransom.

Of the organizations that experienced a successful ransomware attack last year, 86% admitted they paid a ransom to recover their data.

Extortion following a ransom demand occurred in 12% of cases.