Ransomware payments: what changed as extortion economics shifted?

TL;DR: 7,551 ransomware victims and 61 new groups were observed during the reporting period, according to Black Kite, while incident-response datasets showed payment rates falling to 26%, 23%, and 19% in data-exfiltration-only cases. The economics now reward pressure, disclosure, and operational disruption more than reliance on any single monetisation model.

Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “Ransomware Payments”.

By the numbers:

• Black Kite observed 7,551 ransomware victims during the reporting period.
• Black Kite observed 61 new ransomware groups during the reporting period.
• Coveware reported that 26% of organizations paid ransomware demands in Q2 2025.

Key questions

Q: What breaks when a ransomware actor can steal data without encrypting systems?

A: The response model breaks because the organisation loses the clear containment logic that encryption creates.

Q: Should organisations prioritise containment or prevention for ransomware?

A: They should do both, but containment deserves priority when exposure is unavoidable.

Q: What are the signs that a ransomware campaign is shifting from covert extortion to public pressure tactics?

A: Warning signs include ransom notes appearing on a public website, repeated pressure on supply chain partners, and threat actors using multiple channels to widen exposure beyond the affected environment.

Practitioner guidance

• Reduce standing access across SaaS and enterprise applications Review accounts, tokens, and delegated access that can reach sensitive data stores or cross-tenant resources.
• Segment high-value data paths from everyday operator access Separate administrative access, service access, and business-user access so that one compromised identity cannot both discover data and execute disruptive actions.
• Prioritise third-party access offboarding and token revocation Track external accounts, API tokens, and partner integrations through the full access lifecycle, including rapid revocation when relationships end or risk changes.

Bottom line: Ransomware is increasingly an access and disclosure problem as much as an encryption problem, which changes what defenders must protect first.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →