Ransomware: the economics behind the incident

Ransomware started as encryption: files locked, key sold. That model is now the minority of the business. The dominant pattern is extortion built on exfiltration - the data is copied out, and the threat is publication rather than denial of access. Many incidents involve no encryption at all, which matters because a company with perfect backups is fully protected against the old model and not at all against the new one.

The economics changed with it. Encryption-only extortion is a bet that restoring from backup is more expensive than paying. Exfiltration extortion is a bet on regulatory exposure, customer contracts and reputation, none of which a backup addresses. That is why payment rates have fallen for years while individual demands have risen: the population that pays has narrowed to those with something specific to lose.

The structure behind it is industrial rather than artisanal. Access brokers sell entry, affiliates run the intrusion using tooling licensed from an operator, and the operator takes a cut and runs the leak site. Nobody in that chain needs to be able to write the malware, which is why the supply of incidents is far more elastic than the supply of skilled attackers.

The headline finding of recent years is that most victims do not pay. Verizon's 2026 report found that 69 per cent of ransomware victims paid nothing at all, and Coveware measured a payment rate of around 20 per cent by the end of 2025 - the lowest levels either series has recorded. Two decades of advice not to pay finally shows up in the numbers, helped considerably by better backups, better insurance discipline and the accumulating evidence that paying does not reliably prevent publication.

The victims who still pay are not a random sample. They cluster where downtime is measured in revenue per hour, where the exfiltrated data carries regulatory weight, and where a contractual obligation to a larger customer makes silence worth buying. That selection is why the average payment keeps rising even as the payment rate falls: the marginal payer has left the population, and the remaining payers are the ones with the most at stake.

The aggregate flow has fallen with the rate. Chainalysis, tracking payments on-chain, put total ransomware receipts at roughly 820 million dollars in 2025, down about 8 per cent on the prior year and well below the peak. That is one of the few numbers in cyber security measured by observation rather than by survey, which makes it unusually reliable - and it is a floor rather than a total, since it counts only what moves through identified addresses.

The chain is standardised enough to describe generically. Someone sells access - a credential from an infostealer log, an unpatched edge device, a session token. An affiliate uses it to move through the network, finds the data worth taking, and copies it out. Encryption, if it happens, comes last, because it is the step that announces the intrusion and ends the quiet part.

Then the negotiation begins, and it follows a script. An initial demand is set high, deliberately: it anchors the conversation and costs the attacker nothing. A leak site posting adds a deadline. Partial publication demonstrates that the data is real. Every step is designed to move the victim's estimate of publication risk, which is the only variable that determines whether a payment happens.

Verizon's 2026 report recorded a structural change at the front of this chain: exploitation of vulnerabilities overtook stolen credentials as the leading initial entry point for the first time in the report's history. That shifts where defence has to sit - patching cadence on internet-facing systems rather than password hygiene alone - and it shifts which companies are exposed, since edge devices are concentrated in exactly the mid-sized organisations least likely to patch quickly.