96% of surveyed UK business leaders from companies with revenues of £100 million+ believe that ransomware payments should be banned across both public and private sectors.

More than a third (34%) of UK business leaders who support a proposed ransom payment ban believe it would lead to increased government support and intervention to safeguard cyber resilience.

Yearly data from 2024 shows that while ransomware attacks and the number of active gangs have grown, ransom payments saw a significant drop

The median ransom demand decreased by a third between 2024 and 2025.

Nearly 50% of companies paid a ransom to recover their data, which is the second highest rate of ransom payment for demands in six years.

State and local government reported the highest median ransom payment at $2.5 million.

Organisations with $250 million revenue or less saw median ransom demands of less than $350,000.

The median ransom payment was $1 million.

Companies with over $1 billion in revenue faced a median ransom demand of $5 million.

Healthcare reported the lowest median ransom payment at $150,000.

53% of companies that paid the ransom successfully negotiated a lower amount than the initial demand.

In 71% of cases where companies paid a smaller ransom than the initial demand, negotiation played a role, either directly or with third-party assistance.

The median ransom payment dropped by 50% from $2 million in 2024 to $1 million in 2025.

Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.

Ransom payment values declined by 35%.

44% of cyber insurance policyholders that experienced a ransomware incident opted to pay the ransom when deemed reasonable and necessary.

The average ransom demand in 2024 was $1.1 million.

The average ransom demand in the latter half of 2024 fell below $1 million for the first time in more than two years.

The Black Basta variant had the highest average ransom demand at $4 million.

Ransom demands from threat actors decreased by 22% year-over-year (YoY) in 2024.