No One’s Paying the Ransom. So Attackers Changed the Game.

For years, ransomware gangs held the world hostage with a simple equation: lock up the data, demand a ransom, and wait for payment. In 2019, that playbook worked spectacularly, roughly 85% of victims paid up, desperate to get operations back online. Fast-forward to today, and the tide has turned. According to Coveware’s 2025 Q4 report, only 23% of victims now pay ransom demands, marking a dramatic collapse in the profitability of traditional ransomware.

But before we celebrate, let’s get one thing straight: cybercriminals aren’t losing, they’re evolving.

The Extortion Economy

The encryption phase of ransomware was never the real innovation; it was the leverage. When that leverage stopped working, attackers didn’t quit; they changed tactics. Enter data exfiltration, where the theft of sensitive data becomes the ransom note.

Today, more than three-quarters of ransomware incidents (76%) involve data theft, not just system encryption. Criminals learned that downtime isn’t the ultimate bargaining chip, reputation is. A locked server can be restored from backup. But a leaked trove of customer records, financial data, or intellectual property? That’s permanent damage.

Public “leak sites,” sample data dumps, and coordinated PR humiliation campaigns are the new weapons of choice. As Coveware’s analysts put it, these are “forms of leverage that neither downtime nor flawless backups can resolve.”

In short: criminals realized they could skip the lock and go straight for the vault.

The Split in the Underground

Like any maturing industry, the ransomware market has diverged into two camps:

1. Volume Players – Ransomware-as-a-Service (RaaS) operators peddle malware to affiliates, focusing on small and mid-sized companies that lack mature defenses. Think of it as cybercrime’s “franchise model.”
2. Specialists – Elite groups targeting large enterprises, where the potential payout justifies months of reconnaissance, custom tooling, and precision execution.

Interestingly, while payment rates have plunged, so have average ransom amounts, down 66% in 2025 to $376,941. The median payment has dropped to $140,000. This is what happens when “the whales” stop paying and the minnows can’t afford to.

As one Coveware analyst noted, attorneys who once advised payment as a form of damage control are now “becoming extinct.” Non-payment has become the new norm, both ethically and operationally.

You Might Also Like: The Rising Cost of Ransomware Insurance Claims

The Next Phase: Smart, Surgical, and Ruthless

With declining returns, attackers are now chasing what Coveware calls the “white whales,” global enterprises with deep pockets, brand equity, and valuable data. Expect fewer but more sophisticated attacks, aimed at organizations where exfiltrated data can command high ransoms or dark-market resale value.

Attackers are leveraging everything from AI-driven reconnaissance to social engineering and deepfake-enabled business email compromise (BEC) schemes. They’re no longer just encrypting files, they’re exploiting trust, urgency, and human behavior.

The New Defense Playbook

The fall of ransomware’s traditional model offers a rare window of opportunity for defenders, if they seize it. Here’s what needs to change:

• Shift focus from prevention to containment. Assume breach. Build for resilience.
• Treat data exfiltration as inevitable. Invest in data discovery, encryption at rest and in motion, and least-privilege access controls.
• Make incident response a cultural reflex. Response plans shouldn’t live in binders, they should live in muscle memory.
• Kill the silence. Create psychological safety so employees report suspicious clicks or errors without fear. Minutes matter.
• Adopt continuous security hygiene. Penetration testing, phishing simulations, and red team exercises aren’t optional, they’re operational.

The Bottom Line

Ransomware didn’t die, it just stopped needing to encrypt. What’s left is a new kind of cyber extortion that thrives on fear, exposure, and the reputational cost of inaction.

For enterprises, the real challenge isn’t about deciding whether to pay, it’s about building a system so resilient that payment is never even on the table.

Because in this new era of cybercrime, the question isn’t if your data will be stolen, it’s whether your defenses are strong enough to make it worthless when it is.