There’s a version of this question that gets asked in the first hour of every ransomware incident, usually by someone who has never had to answer it before: should you pay ransomware demands, or hold the line and rebuild? For years the honest answer was “it depends, and nobody has good numbers.” That’s no longer entirely true. Between quarterly incident-response tracking, annual victim surveys, and blockchain analysis of the payments themselves, there’s now a real evidence base, and it points somewhere more specific than either “never pay” or “just pay and move on.”
How Many Organizations Actually Pay
The headline number for 2025 is a steep decline. Coveware, which tracks payment outcomes across the incident response cases it handles directly, put the payment rate at just 23% in Q3 2025, a historic low, and down further still, to 19%, for incidents involving data theft alone with no encryption. That’s a meaningful shift from a few years ago, when payment was closer to a coin flip.
Sophos’s annual survey, which asks a broader population of IT and security leaders about ransomware incidents from the prior year, tells a less dramatic story: roughly half of organizations that suffered a ransomware attack in the report’s window paid. The gap between these two figures isn’t a contradiction, it’s a difference in what’s being measured. Coveware’s numbers come from actual cases its negotiators worked, weighted toward organizations sophisticated enough to bring in professional incident response. Sophos surveys a wider cross-section, including smaller organizations with fewer options and less leverage. Read together, the honest takeaway is: payment rates are trending down industry-wide, and they fall further the more resourced and prepared an organization is.
Chainalysis’s blockchain tracking backs this up from a different angle. Total ransomware payment volume dropped to $813.55 million in the most recent full year tracked, a 35% decline from $1.25 billion the year before, the first year-over-year drop since 2022. Fewer victims paying, and paying less when they do.
What Paying Actually Gets You
The decryption-key promise is the whole premise of paying, so it’s worth being precise about how often it holds up. Sophos’s 2025 data shows 97% of organizations that had encrypted data ultimately recovered it, but that figure blends every recovery path, not payment alone. Of the full ransomware-victim population, 49% paid the ransom and recovered data that way, while 54% restored from backups and 29% used other methods (these overlap, since many organizations run more than one recovery path at once as insurance against the others failing).
What this means in practice: paying is not the reliable, singular fix it’s sometimes assumed to be, but it also isn’t the near-guaranteed loss the “92% get nothing” statistic, now several years stale, once suggested. Modern ransomware operators run something closer to a business than a scam; a group with a reputation for taking payment and not delivering a working decryptor burns its own credibility fast, which is part of why functional decryptors are now the norm rather than the exception when payment happens.
Negotiation also moves the number that matters most: what’s actually paid. Sophos found the median ransom payment in 2025 was $1 million, down 50% from $2 million in 2024, and 53% of paying organizations negotiated the demand down from the initial ask. Separately, incident response teams report that regardless of the opening demand, negotiated settlements frequently land in a $150,000–$250,000 range once the back-and-forth is done, and that in the back half of 2024, the gap between initial demand and final payment averaged over 50%. The number an attacker opens with is a negotiating position, not a price tag.
What Paying Doesn't Get You
None of this changes the risks that make “pay” the wrong default answer for most organizations, even when it’s an option:
Payment doesn’t undo a data exfiltration. If the attacker copied files before encrypting them, a standard practice in most current ransomware operations, paying for a decryption key does nothing to prevent that stolen data from being sold, leaked, or used for a second extortion attempt weeks or months later. Some negotiators report that only around 30% of negotiations end in payment at all, in part because more organizations are recognizing that paying to suppress already-stolen data has limited real-world effect once it’s left the network.
Payment carries real legal exposure. In the US, the Treasury’s Office of Foreign Assets Control treats ransomware payments to sanctioned actors or jurisdictions as a strict-liability sanctions issue, meaning an organization can be held civilly liable even if it didn’t know the payment reached a sanctioned party. Penalties can run into the hundreds of thousands of dollars per violation, or twice the transaction amount. Voluntary self-disclosure and early FBI notification are recognized mitigating factors, but they don’t eliminate the exposure. This is a legal determination that needs to be made by counsel before any payment goes out, on a case-by-case basis.
And payment doesn’t buy goodwill. Paying doesn’t verifiably remove attacker access, doesn’t guarantee the group hasn’t left a second foothold for a repeat visit, and doesn’t change the fact that the initial vulnerability that let them in is still there until it’s fixed.
The Variables That Actually Decide the Answer
The data points to a few factors that matter more than any blanket policy:
Backup integrity. Organizations with clean, tested, offline backups increasingly don’t need to weigh this question at all, Sophos’s 2025 figures show backup-based recovery now edging out ransom payment as the primary recovery path, and recovery speed has improved sharply where backups held (53% of victims recovered fully within a week in 2025, versus 35% the year before).
What was actually taken. Encryption-only incidents and data-theft incidents are different problems with different remedies, and the “pay or don’t” calculus for each is not the same one.
Regulatory and contractual exposure. Healthcare, financial services, and government-adjacent organizations often face notification and liability considerations that shift the analysis regardless of what backups look like.
Insurance posture. Many cyber policies now require the insurer’s incident response team and legal counsel to be involved before any payment decision, which is, not coincidentally, the arrangement that tends to produce the best-informed outcomes.
Where This Leaves the Decision
The data doesn’t support a universal answer, and any vendor telling you it does is selling something. What it supports is this: paying is no longer the default, the number of organizations paying is falling every quarter, the amounts being paid are shrinking through negotiation, and the decision itself increasingly belongs to a room that includes legal counsel, the insurer, and an incident response team with negotiation experience, not the IT lead alone at 2 AM.
That’s the practical reason ransomware incident response retainers exist before an attack, not after: by the time the question “should we pay” is on the table, you want negotiators who know current market rates, counsel who can clear the sanctions question fast, and a forensics team who can tell you, with evidence, exactly what was actually taken, because that answer changes everything else.
This post summarizes publicly reported industry data for informational purposes. It isn’t legal or financial advice, and the decision to pay or not pay in any real incident should be made with your legal counsel, insurer, and incident response team, based on the specifics of that incident.
