The Economics of Ransomware Payments: Decision Factors, Outcomes, and Market Dynamics

What Did This Cybersecurity Research Find?

This cybersecurity threat economics study analyzed 500 ransomware incidents to map the payment decision process, actual recovery outcomes, and downstream market effects. Cybersecurity teams that paid ransoms recovered full data in only 65% of cases, and organizations that paid were 2.8x more likely to be targeted again within 12 months, supporting the law enforcement position that payment perpetuates the ransomware economy.

Key Findings

• 1Only 65% of organizations that paid ransoms recovered all their data
• 2Paying organizations were 2.8x more likely to be targeted again within 12 months
• 3Median ransom payment was $275,000 for mid-market organizations in 2024
• 4Total incident cost (including recovery) averaged 5x the ransom amount paid
• 5Organizations with tested offline backups recovered without payment 91% of the time

How Does This Apply to Cybersecurity Careers?

Incident responders can present evidence-based guidance during ransomware negotiations. Security leaders can make informed decisions about ransomware response policies and insurance.

Who Should Read This?

Frequently Asked Questions