Companies with over $1 billion in revenue faced a median ransom demand of $5 million.

53% of companies that paid the ransom successfully negotiated a lower amount than the initial demand.

Nearly 50% of companies paid a ransom to recover their data, which is the second highest rate of ransom payment for demands in six years.

State and local government reported the highest median ransom payment at $2.5 million.

Healthcare reported the lowest median ransom payment at $150,000.

Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.

Ransom payment values declined by 35%.

The Black Basta variant had the highest average ransom demand at $4 million.

The average ransom demand in 2024 was $1.1 million.

Ransom demands from threat actors decreased by 22% year-over-year (YoY) in 2024.

The average ransom demand in the latter half of 2024 fell below $1 million for the first time in more than two years.

44% of cyber insurance policyholders that experienced a ransomware incident opted to pay the ransom when deemed reasonable and necessary.

Of organizations that paid a ransom, 82% paid less than the initial ransom.

36% of organizations affected by ransomware opted not to pay a ransom.

The total value of ransomware payments fell in 2024.

64% of victim organisations did not pay ransoms this year, compared to 50% two years ago.

There was a noticeable decrease in the median ransom amount paid.

Of organizations that paid a ransom, 60% paid less than half of the initial ransom.

Of the organizations that experienced a successful ransomware attack last year, 86% admitted they paid a ransom to recover their data.

Extortion following a ransom demand occurred in 12% of cases.