Ransomware Attacks Surge 50% Amid Declining Payments in 2025
By John Nada·Feb 27, 2026·5 min read
Ransomware attacks rose by 50% in 2025, with a shift towards smaller targets, while payments declined, posing challenges for the financial system.
Ransomware attacks surged by 50% in 2025 as hackers increasingly targeted small and medium-sized enterprises, according to blockchain analytics firm Chainalysis. The firm reported nearly 8,000 total leak events, a significant rise from the previous year. Despite this increase in attacks, total on-chain ransom payments fell to $820 million, reflecting an 8% decrease from 2024.
The rise in ransomware incidents can be attributed to several factors, including a strategic pivot by hackers who have shifted their focus from larger corporations to smaller and medium-sized enterprises (SMEs). This shift is particularly noteworthy given that larger organizations typically have more resources and robust cybersecurity measures in place. Chainalysis's findings indicate that the number of leak events has reached an alarming level, showcasing a growing trend of cybercriminals exploiting vulnerabilities in smaller entities that may not have the same level of preparedness as their larger counterparts.
Increased regulatory scrutiny and enforcement actions aimed at money laundering have contributed to the decline in ransom payments. High-profile cases and investigations have led many larger firms to adopt a strategy of refusing to pay ransoms altogether. This refusal not only disrupts the revenue streams of cybercriminals but also serves as a deterrent for potential attackers. Corsin Camichel, founder of eCrime.ch, noted the change in targeting strategy, suggesting that smaller victims tend to pay faster, but the data indicates that overall payments are trending downward.
This strategic shift by attackers raises important questions about the future landscape of ransomware. Smaller businesses, often lacking sophisticated cyber defenses, may feel pressured to comply with ransom demands to avoid costly disruptions. However, as Chainalysis points out, the data shows a divergence between the number of public claims of ransom payments and the actual monetary transactions, indicating that attackers are working harder for diminishing returns. This could lead to a re-evaluation of tactics among ransomware groups as they adjust to a more complex and resistant target environment.
Another critical factor influencing the dynamics of ransomware payments is the declining average price for victim access on the dark web. The average price for accessing a victim's data has dropped significantly, from $1,427 in early 2023 to just $439 at the beginning of 2026. This decline underscores a significant shift in the market, driven by an influx of affordable ransomware software and AI tools that streamline attacks. The availability of these low-cost solutions has resulted in a higher volume of attempted breaches, making it easier for less sophisticated hackers to launch attacks.
Chainalysis emphasized that the industrialization of hacking has led to an oversupply of low-cost, operationally constrained inventory in the market, effectively depressing ransom prices. This trend not only signifies a change in the economics of cybercrime but also poses a serious challenge for organizations attempting to defend against these threats. As the barrier to entry for launching ransomware attacks decreases, the number of potential attackers grows, which could lead to an even greater frequency of attacks on vulnerable organizations.
Despite the downturn in blockchain ransomware payments in 2025, the beginning of 2026 has already seen significant losses from crypto-related exploits and scams. A recent report from cybersecurity firm CertiK revealed that a staggering $370.3 million was stolen in January alone, primarily through phishing scams which accounted for $311.3 million of the losses. This stark figure underscores the ongoing vulnerabilities within the crypto landscape, despite regulatory advancements aimed at curbing such activities. The persistence of these scams illustrates the need for ongoing vigilance and the implementation of robust security measures by both individuals and organizations operating in the cryptocurrency space.
The increasing prevalence of these attacks and the strategic shift toward smaller victims signal a concerning trend for the financial system. As ransomware becomes more accessible to a broader range of attackers, organizations must adapt not only their cybersecurity measures but also their risk management strategies. The evolving landscape of cybercrime continues to challenge businesses and regulators alike, highlighting the critical need for robust defenses and effective policy responses.
Moreover, the impact of ransomware attacks extends beyond immediate financial losses. Organizations face potential reputational damage, loss of customer trust, and operational disruptions that can have long-term consequences. This reality emphasizes the importance of not only investing in advanced cybersecurity infrastructure but also fostering a culture of security awareness among employees. Organizations must prioritize training and education to equip their workforce with the tools necessary to recognize and respond to potential threats, thereby strengthening their overall cybersecurity posture.
As ransomware tactics continue to evolve, financial institutions and policymakers must remain vigilant and collaborative in their efforts to combat these cyber threats. The juxtaposition of rising attack frequency against falling ransom payments reflects a complex environment in which both hackers and organizations must navigate shifting dynamics. Understanding these trends is vital for financial institutions and policymakers as they forge a path forward in combating cyber threats. The need for comprehensive strategies that encompass prevention, response, and recovery is more critical than ever as the landscape of cybercrime becomes increasingly sophisticated.
In light of these challenges, regulatory bodies must also consider the implications of declining ransom payments on the broader financial ecosystem. With a growing number of SMEs falling victim to ransomware, there is a pressing need for tailored support and resources to help these organizations bolster their defenses. Initiatives aimed at enhancing cybersecurity awareness and providing guidance on best practices could play a pivotal role in mitigating the risks associated with ransomware attacks.
As we move deeper into 2026, the ongoing evolution of ransomware tactics and the broader implications for the financial system will demand attention from stakeholders across the spectrum. The landscape of cybercrime is not static, and as both attackers and defenders adapt to new realities, the continuous development of innovative solutions and collaborative efforts will be essential in the fight against ransomware and other cyber threats. Organizations must remain proactive, leveraging technology and expertise to stay one step ahead of cybercriminals in an increasingly hostile digital environment.