Ransomware economics shifted as payments fell and stakes rose

At a glance

What this is: This analysis shows that ransomware remained high-volume, but payment behaviour became less reliable and extortion models more diversified.

Why it matters: For IAM and NHI practitioners, the lesson is that exposed access paths, SaaS exposure, and third-party privilege now shape extortion pressure as much as encryption does.

By the numbers:

• Black Kite observed 7,551 ransomware victims during the reporting period.
• Black Kite observed 61 new ransomware groups during the reporting period.
• Coveware reported that 26% of organizations paid ransomware demands in Q2 2025.
• Veeam reported that payment rates fell to 19% for data exfiltration-only incidents in Q3 2025.

Context

Ransomware economics now hinge on leverage, not just encryption. As payment conversion becomes less predictable, attackers compensate by scaling victim counts, expanding brand churn, and increasing the pressure created by stolen data and public disclosure.

That shift matters for identity governance because many ransomware campaigns begin with exposed access paths, reused credentials, or over-permissioned third-party access. When a single foothold can expose SaaS data or enterprise applications at scale, identity security programme controls become part of ransomware resilience rather than an isolated IAM concern.

Key questions

Q: What breaks when a ransomware actor can steal data without encrypting systems?

A: The response model breaks because the organisation loses the clear containment logic that encryption creates. Data theft only extortion shifts pressure to disclosure, legal exposure, and customer trust, so a clean restore does not remove the attacker’s leverage. Teams need to assume that exfiltrated data can remain a coercion asset even when recovery is technically successful.

Q: Should organisations prioritise containment or prevention for ransomware?

A: They should do both, but containment deserves priority when exposure is unavoidable. Prevention reduces the chance of compromise, while containment determines whether one successful intrusion becomes a business-ending event. In modern opportunistic ransomware, the second control often decides the real outcome.

Q: What are the signs that a ransomware campaign is shifting from covert extortion to public pressure tactics?

A: Warning signs include ransom notes appearing on a public website, repeated pressure on supply chain partners, and threat actors using multiple channels to widen exposure beyond the affected environment. These tactics usually indicate an attacker is trying to increase urgency rather than relying only on file encryption or private negotiation. Security teams should treat that as a sign of broader extortion intent.

Q: Should security teams treat ransomware payment rates as a measure of programme effectiveness?

A: No. Payment rates reflect the attacker’s leverage, the victim’s circumstances, insurer involvement, and legal advice, not just security maturity. A falling payment rate does not mean the environment is safer if exposed identities, overprivileged access, or unmanaged third-party connections still allow theft at scale.

Technical breakdown

Why data theft only extortion changes the attack economics

Data theft only extortion removes the operational burden of encryption and shifts the attacker’s leverage to reputational harm, legal exposure, and business interruption. That model scales well when one compromised account, API token, or SaaS foothold can expose many records across multiple tenants or applications. The attacker no longer needs to disrupt the environment to create urgency, only to prove that sensitive data has been copied and can be released. In practical terms, the pressure point becomes access scope and data reach, not just payload deployment.

Practical implication: Treat exposed identities and access paths as extortion enablers, not just intrusion evidence.

How mixed encryption and exfiltration campaigns increase coercion

Mixed campaigns combine the immediacy of service disruption with the longer tail of data exposure. Encryption creates operational urgency, while exfiltration adds uncertainty about customer trust, regulatory reporting, and downstream fraud. Groups such as those described in the source often use both to widen the victim’s decision set: restore quickly, negotiate, or manage disclosure risk. This is not just a malware problem. It is an access and identity problem because the attacker needs sufficient privilege to move laterally, access data stores, and persist long enough to complete both phases. See the Identity Security Programme Guide.

Practical implication: Map privileged accounts and service identities to likely encryption and exfiltration paths before a ransomware event does.

Why payment rates and payment sizes can move in opposite directions

Payment conversion and payment size measure different parts of the same extortion market. A lower percentage of victims paying does not stop large payments from occurring when the victim is highly exposed, time-constrained, or facing sensitive data disclosure. That creates a market where attackers can lose conversion but still chase larger payouts from the few organisations most able or willing to pay. For defenders, the important metric is not only whether victims pay. It is whether the organisation’s identity, data, and recovery controls reduce the leverage available to the attacker at all. See the Ransomware Response and Recovery Guide.

Practical implication: Measure how much leverage a compromised identity can create, not just whether a ransom demand is likely to be paid.

Threat narrative

Attacker objective: The objective is to extract payment by turning stolen data, service disruption, and disclosure risk into compounding pressure on the victim.

1. Entry typically begins with a compromised access path into SaaS, enterprise application, or other exposed infrastructure that gives the attacker a foothold without needing full environment compromise.
2. Escalation comes from using that foothold to reach sensitive data, expand privilege, or stage encryption and theft across multiple victims from a single access route.
3. Impact is created when attackers combine data theft, public disclosure, and sometimes encryption to raise pressure even when victims are less willing to pay.

NHI Mgmt Group analysis

Data-exfiltration-only extortion has become a governance problem, not just a ransomware variant. Once attackers can steal data through a single exposed access path, the organisation is negotiating over disclosure risk rather than system availability alone. That changes the control boundary for identity teams because compromised service accounts, SaaS tokens, and third-party access can create the leverage. Practitioners should treat access scope as part of extortion resilience, not only incident response.

Ransomware has become a market of asymmetric leverage. The article’s payment data suggests that lower conversion does not remove the incentive to attack; it pushes actors toward larger, more selective, and more disruptive coercion models. That is why the market can grow in victims and groups even while some payment rates fall. The security implication is that disruption, exposure, and trust loss are now separate decision levers for criminals, not one combined outcome.

Identity governance is now one of the few controls that can reduce both initial access and extortion reach. If a compromised account cannot reach sensitive repositories, enterprise applications, or cloud data stores, the attacker’s ability to create pressure collapses. That is especially true where access is time-bound, tightly segmented, and continuously reviewed across human and non-human identities. Identity security programme design is therefore a ransomware resilience control, not just an IAM maturity exercise.

Ransomware economics are being shaped by the breadth of exposed enterprise identity, not just by malware capability. Groups can recycle the same access pattern across SaaS, cloud, and business applications when organisations fail to constrain privilege and offboard third-party access cleanly. The article’s data on rising victim counts and new groups fits that pattern. Practitioners should assume the market will keep adapting around the weakest identity boundary, then close that boundary first.

Standing access exposure is the real extortion multiplier. The more persistent the compromised credential, token, or service account, the easier it is for attackers to shift from theft to pressure, then from pressure to disruption. That is the specific governance failure this market pattern exposes. Organisations should remove standing access paths that can be reused across systems or tenants before they become the attacker’s leverage point.

Read next: Ransomware Response and Recovery Guide

What this signals

Extortion leverage now depends on access breadth: ransomware operators gain more from identities that can reach many systems than from any single exploit. That means access review, token revocation, and partner offboarding have become part of extortion prevention, not just governance hygiene.

The next programme question is not whether ransomware payments rise or fall. It is whether a compromised service account, token, or delegated integration can still become the shortest path from one foothold to broad data exposure and coercive pressure.

For practitioners

• Reduce standing access across SaaS and enterprise applications Review accounts, tokens, and delegated access that can reach sensitive data stores or cross-tenant resources. The goal is to shrink the number of identities that can support exfiltration or disruptive encryption from a single foothold.
• Segment high-value data paths from everyday operator access Separate administrative access, service access, and business-user access so that one compromised identity cannot both discover data and execute disruptive actions.
• Prioritise third-party access offboarding and token revocation Track external accounts, API tokens, and partner integrations through the full access lifecycle, including rapid revocation when relationships end or risk changes.
• Build extortion scenarios into recovery planning Exercise what happens when data theft occurs without encryption, when both occur together, and when public disclosure is the main coercion lever.
• Use payment trends as a signal, not a strategy Do not treat lower payment rates as evidence that extortion risk is falling. Reassess how much leverage an attacker can create through the identities and access paths already in your environment.

Key takeaways

• Ransomware is increasingly an access and disclosure problem as much as an encryption problem, which changes what defenders must protect first.
• Victim volume and group counts rose while some payment rates fell, showing that attacker economics are adapting rather than weakening.
• The control that matters most is the one that limits how far a compromised identity can move, what data it can reach, and whether it can still create extortion leverage.

Related NHI Mgmt Group resources: Identity Security Programme Guide · Ransomware Response and Recovery Guide · MDR Guide · SOC Guide

Key terms

• Data Extortion: Data extortion is a breach pattern where attackers steal information and then pressure the victim by threatening to publish or sell it. The value of the attack comes from leverage created by exposure, uncertainty, and downstream misuse of the data.
• Extortion Leverage: The amount of pressure an attacker can create from access, stolen data, and business disruption. In ransomware cases, leverage increases when one compromised identity can reach many systems, exfiltrate valuable data, or persist long enough to support both theft and disruption.
• Standing Access Exposure: Persistent access that remains valid long enough for an attacker to reuse after initial compromise. In ransomware contexts, standing access includes credentials, tokens, and delegated connections that are not tightly time-bound or quickly revoked, making them ideal for lateral movement and exfiltration.
• Payment Conversion: The percentage of shoppers who complete a purchase after starting checkout. It is a practical indicator of whether fraud controls, authentication steps, and user experience are working together or fighting each other. For merchants, conversion is not only a sales metric, but also a sign of checkout control quality.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader attack paths that drive ransomware and extortion risk.