Ransomware Statistics (2025): Attacks and Payments

How many ransomware attacks were there in 2025?

No one counts every attack, but every major measure rose. The FBI's Internet Crime Complaint Center received 3,611 ransomware complaints in 2025, up 14% from 3,156 in 2024 and the third straight annual increase. Of those, 2,118 came from organizations in critical infrastructure sectors such as healthcare, manufacturing and government. Chainalysis reports that victims claimed on ransomware gangs' data leak sites grew 50% in 2025, an all-time high.

Ransomware is also a larger share of data breaches. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of the breaches it analyzed, up from 44% a year earlier. About 96% of ransomware victims in its data were small and midsize businesses with fewer than 1,000 employees.

What percentage of ransomware victims pay the ransom?

About one in four or five, and falling. In cases handled by the incident-response firm Coveware, 23% of victims paid in Q1 2026, after a historical low of about 20% in Q4 2025. In Q1 2019, 85% of Coveware's cases ended in a payment. Figure 1 shows the decline as 100-case panels.

Other sources agree on the direction. Verizon found that 69% of ransomware victims in its 2025 data did not pay, up from 65%. Chainalysis estimates that the share of victims paying "potentially reached an all-time low" of 28% in 2025. Sophos's survey gives a higher figure, 48%, because it asks only organizations whose data was encrypted.

How much money do ransomware gangs make?

More than $820 million in 2025, according to blockchain analysis firm Chainalysis, down from $892 million in 2024 and a record $1.25 billion in 2023. Chainalysis expects the 2025 figure to approach or exceed $900 million as it finds more payments; it has raised every past year's total after first publishing it.

Bank reports tell the same story. Treasury's Financial Crimes Enforcement Network counted about $1.1 billion in ransomware payments from 1,512 incidents in 2023 and $734 million from 1,476 incidents in 2024, or more than $2.1 billion over 2022–2024.

Typical payments depend on who is counting. Chainalysis puts the median on-chain payment at $59,556 in 2025. Verizon's median ransom paid was $139,875. Sophos's survey of organizations hit by ransomware reports a median payment of $769,000, down from $1 million. Each source draws on a different set of victims, so the figures are not interchangeable.

Which industry is most targeted by ransomware?

Healthcare, by FBI complaints. Healthcare and public health organizations filed 460 ransomware complaints in 2025, nearly double the 238 they filed in 2024, overtaking critical manufacturing (355). Financial services (258), government facilities (233) and information technology (232) followed. Complaints rose in all 14 critical infrastructure sectors IC3 charted.

The FBI's most-reported variants in 2025 were Akira, Qilin and INC./Lynx/Sinobi. CISA and the FBI say Akira alone had claimed about $244.17 million in ransom proceeds by late September 2025.

What is the biggest ransomware attack?

By people affected, the February 2024 attack on Change Healthcare, a UnitedHealth Group subsidiary that processes medical claims. Change Healthcare told HHS that approximately 192.7 million individuals were affected, the largest breach ever reported to the agency. UnitedHealth CEO Andrew Witty told the Senate Finance Committee the company paid a $22 million ransom.

The ransom was a small part of the cost. UnitedHealth's 2024 annual report lists $2.2 billion in direct response costs and an estimated $867 million in business disruption, about $3.07 billion together. The ransom was less than 1% of that. By comparison, Colonial Pipeline paid a ransom of $4.4 million in 2021, of which the Justice Department later seized about $2.3 million.

How do ransomware attacks start?

Most often through email. In Sophos's 2026 survey of 2,158 organizations hit by ransomware, 26% named a malicious email and 24% phishing as the root cause, 50% combined. Stolen or compromised credentials accounted for 23%. Exploited software vulnerabilities, the top cause a year earlier at 32%, fell to 18%.

Methodology & caveats

Each source measures something different, and none counts every attack. FBI IC3 figures are complaints that victims chose to file; IC3 says reported losses exclude lost business, time, wages and third-party remediation. Critical infrastructure sector values are read from the data labels on IC3's 2024 and 2025 sector charts, and the 2,118 total is the sum of the 2025 sector values, calculated by data.co. The 2020–2025 complaint series combines the three-year tables in IC3's 2022, 2024 and 2025 reports. Verizon's percentages are shares of breaches in its contributors' dataset.

Payment rates come from Coveware's quarterly reports and cover only Coveware's cases. We show the quarters for which a report states a rate in its text; Q4 2025 is described as "approximately 20%". The Q1 2019 figure (85%) is quoted in Coveware's Q1 2022 report. Payment totals are Chainalysis's latest published value for each year: 2020 from its 2022 report, 2021 from its 2023 report, 2022 from its 2024 report, 2023 from its 2025 report, and 2024 and 2025 from its 2026 report. Chainalysis revises earlier years upward as it identifies more ransomware wallets, so recent years are likely to rise. FinCEN figures come from Bank Secrecy Act filings by U.S. financial institutions and are not directly comparable.

Root causes are from Sophos's survey of IT and security leaders at organizations hit by ransomware in 17 countries, conducted January–March 2026. Change Healthcare costs are as reported by UnitedHealth for 2024; the $3.07 billion total and the ransom's share of it are calculated by data.co. All values are nominal U.S. dollars, not adjusted for inflation.