Ransom payment rates have fallen to record lows while the number of victims keeps climbing, and those two facts together explain more about your risk than either does alone. Published victim counts reached 7,551 in the twelve months to March 2026, up nearly a quarter on the prior period and a fourth consecutive record, with one month alone passing 860. Over the same stretch the share of victims choosing to pay dropped into the twenties. That combination is not a contradiction. It is the market adjusting: when fewer targets pay for a decryption key, the pressure moves to something they will pay for, and for most businesses that turns out to be the data rather than the systems.
The Five Numbers Worth Understanding
These figures are widely reported and rarely read together, which is where the useful conclusion hides.
- 7,551 published victims in twelve months, up 24.9%. A fourth straight record year, so volume is rising rather than plateauing.
- Payment rates at a multi-year low. Depending on the dataset, somewhere in the twenties, down sharply from historical norms.
- Average payment up, median payment down. Fewer payers, but the ones who pay are paying more, so the distribution has stretched.
- Extortion increasingly does not need encryption. Stolen data is leverage on its own, and it works against firms with excellent backups.
- Your recovery capability answers only half the threat. It restores your operations. It does nothing about publication.
Our note on the traps SMBs fall into with double extortion covers the mechanics behind that last point.
Why Falling Ransom Payment Rates Made Things Harder, Not Easier
Declining payment rates are a genuine defensive success and they changed what attackers optimize for, which is why the experience of being attacked has not improved. When most victims paid, the business model was volume: encrypt widely, ask moderately, collect often. As backups improved and boards became more willing to refuse, that model stopped working, and the response was to find leverage that backups do not address. Stealing the data before encrypting it does that. So does skipping encryption entirely and simply taking the data, which removes the noisy, detectable part of the attack while keeping the part that generates payment. The result is that a firm which invested heavily in recovery may restore in a day and still face the harder conversation. Our earlier piece on how ransomware-as-a-service doubled cyber extortion traced the first half of this shift.
A Stretched Distribution Means Targeting Got Better
An average payment rising while the median falls tells you the population of payers has changed shape, with a small number of high-value cases pulling the mean upward. Attackers are increasingly able to tell, before making a demand, roughly what a victim can pay and what they most need back. They read the files they took. They find the insurance policy, the contracts with penalty clauses, the regulated data, and the material a competitor would value. The demand gets sized to what they learned rather than to a standard rate card. For a smaller business the practical implication is that your exposure is driven by what is sitting in your file shares rather than by your headcount, and firms holding sensitive material for larger clients are worth more to an attacker than their own revenue suggests.
Refusing to Pay Is Now the Normal Position
The most useful consequence of the trend is that declining has become unremarkable, which removes a source of pressure that used to weigh heavily in the room. Five years ago a business refusing a demand felt like it was taking an unusual stance. Today the majority position is refusal, insurers and advisors expect it, and the decision no longer has to be defended as though it were reckless. That matters because a decision made under the belief that everyone else pays is a decision made under a false premise. The honest counterpoint is that the minority who do pay are often those with no viable alternative, and it is a real decision with real consequences rather than a moral failure. Our position is that the decision should be made against a rehearsed plan rather than in the first eight hours, and our incident response planning guide covers what that plan needs to contain.
Recovery Solves Downtime, Not Disclosure
Firms that invested in backup and recovery bought themselves out of the operational half of this threat and are frequently surprised to find the other half intact. The restoration works, systems come back, staff return to their jobs, and then somebody asks what was taken. That question has a different owner, a different timeline, and different obligations attached to it, and it is the one most incident plans handle poorly. The regulatory and contractual clocks start from what was accessed rather than from whether you recovered, and a fast restoration does not shorten them. Our cyber incident containment work treats those as two parallel tracks from the first hour, because run sequentially the disclosure track starts late.
Know What Was Taken, Not Just What Was Encrypted
Determining what data left your environment is a separate investigation from restoring it, and the logging that answers it has to exist beforehand. Encryption is loud and obvious. Exfiltration is quiet, often spread over days, and frequently uses a legitimate cloud storage service so the traffic looks ordinary. If you cannot reconstruct what left, your notification obligations get assessed against the worst reasonable case, which is a materially more expensive position than being able to show precisely which records were touched. Check whether you retain outbound traffic records, cloud storage access logs, and file access auditing for long enough to cover a dwell time measured in weeks. The objection that this logging is expensive and voluminous is fair for a small business, and the proportionate version is to log it for the systems holding the data you would have to notify about, rather than for everything.
Immutable Backups Are Still Worth Every Penny
Nothing above reduces the value of backups you can actually restore, because operational recovery remains the difference between a bad fortnight and an existential event. Attackers routinely go after backup infrastructure first, precisely because it removes the victim’s alternative, so the protection has to be genuinely immutable or genuinely offline rather than merely separate. Test restores rather than backup completion. A job reporting success every night proves the job ran, not that the data is usable, which our note on how often to test backup and recovery covers in more detail. There is a reasonable challenge that immutable storage costs more and complicates retention management, which it does. It is still the cheapest insurance in this category, and our cloud backup practice exists because the version most firms have is not the version they think they have.
The Conversations That Decide Your Outcome
By the time a demand arrives, the decisions that matter were made months earlier, and most of them were about people and relationships rather than technology. Who calls your insurer, and do you know the number without looking. Who speaks to customers whose data was taken, and have they ever drafted that message. Who has authority to approve a payment if it comes to that, and does anyone know what your policy actually covers. These are ordinary management questions that become extraordinarily difficult when asked for the first time during an incident, with the clock running and everybody exhausted.
Write the Customer Notification Before You Need It
A draft notification written calmly, months in advance, is a better document than one written at 2am by somebody who has not slept, and it takes an hour. You are not predicting the incident. You are deciding in advance what your business sounds like when it tells somebody their data was taken: how much detail you give, what you offer, who signs it, and how fast you commit to going out. Keep it short and honest, since the versions that read as legally-managed evasion do more damage than the incident. Have your counsel look at it once while there is no pressure. The counterargument is that every incident is different and a prepared draft will need rewriting anyway, which is true and misses what the exercise produces. It is not the words you are banking, it is the argument about tone and timing, which you have then already had.
Check What Your Insurer Requires Before the Event
Policies increasingly carry conditions about notification windows, approved vendors, and prior consent for payments, and breaching one can reduce or void a claim at the worst possible moment. Read the incident section of your policy now and note the deadlines, whose approval you need before engaging a response firm, and whether your existing IT provider is on an approved list. Firms regularly discover mid-incident that the specialist they called is not covered, or that a 72-hour notification requirement started before anyone thought to read the policy. The objection that this is the broker’s job is fair in principle and unreliable in practice, because the person who needs the answer at midnight is you. Our note on managed detection and response contract traps covers the same class of small print in the service contracts alongside it.
Reduce What Is There to Steal
The only control that lowers extortion leverage rather than managing its consequences is holding less data, and it is the one almost nobody budgets for. Every file share we assess carries years of material nobody needs: exported customer lists from a migration, spreadsheets of personal data pulled for a project that ended, scanned identity documents from a supplier onboarding, and copies of copies made by people who were being careful. None of it supports current operations. All of it lands in a notification if it leaves, and all of it raises what an attacker can threaten you with.
Start with the categories that carry obligations rather than with total volume, since a terabyte of design files is a smaller problem than a single folder of identity documents. Find where personal and regulated data sits outside the systems designed to hold it, and either move it back or delete it. Retention rules are the durable version of this, though a one-off clearout delivers most of the benefit and can be done this quarter. The objection is that deletion feels risky, somebody might need it, and no manager has ever been thanked for removing a file. That instinct is why the problem accumulates, and the counter is to work from the obligation rather than from the possibility: data you are required to be able to produce stays, data retained only because deleting it felt uncomfortable goes. It is the one improvement here that makes a future incident smaller rather than merely shorter.
Frequently Asked Questions
Are ransomware attacks actually decreasing?
No. Published victim counts rose nearly 25% year over year to 7,551, a fourth consecutive record. It is the payment rate that fell, not the attack volume.
Why is the average payment rising if fewer firms pay?
Because the population of payers has narrowed to cases where the attacker found genuine leverage. Fewer, larger payments pull the average up while the median falls.
Do good backups protect us from extortion?
They protect you from downtime. They do nothing about stolen data being published, which is why attackers increasingly steal first and sometimes skip encryption entirely.
How do we know what data was actually taken?
Through logging you retained beforehand: outbound traffic records, cloud storage access, and file access auditing. Without it, your obligations get assessed against the worst reasonable case.
Should we plan to pay or plan to refuse?
Plan to refuse and keep the decision open. Most victims now decline, so refusing is the normal position, and the decision is far better made against a rehearsed plan than in the first eight hours.
Who You Are Taking This Advice From
Mindcore runs containment, recovery, and the awkward week afterward for businesses that do not have a security team to fall back on, which means we spend as much time on notification logistics as on restoring systems. We test restores rather than trusting backup reports, check the policy conditions while there is no incident, and get the customer notification drafted before anybody needs it, and the guidance above comes from incidents we have worked rather than from a threat report. Matt Rosenthal, who leads Mindcore, keeps the firm focused on preparation a business can complete in a quarter rather than a program it will abandon, which here means a tested restore and three named people. You know your obligations. Our job is to make sure the clock does not start before you are ready.
Your Next Move on Extortion Risk
Do the two cheap things first. Test a restore this month, of something that matters, measured end to end rather than by whether the backup job reported success, because a great many firms discover the gap only when it is expensive. Then write the customer notification draft and have somebody with legal judgment read it once. Between those, spend twenty minutes finding out whether you retain the logs that would tell you what left your environment, since that single answer decides whether a future notification is precise or worst-case. Read your insurance policy’s incident section and write the deadlines and the approved-vendor rules somewhere you would find them at midnight. The trend in the numbers is genuinely good news: most businesses now refuse, and refusing works when you can restore. What it has not changed is the second half of the threat, and that half is answered by preparation rather than by technology. If you want help testing the restore and building the disclosure side of the plan, book a free strategy call and we will start with your last recovery test.
