Nobody Pays Anymore: Ransomware's Pivot to Pure Extortion

Something genuinely encouraging happened to ransomware economics, and the industry has been slow to explain what it means. Blockchain payments to ransomware operations fell from roughly 1.25 billion dollars in 2023 to 892 million in 2024 — a figure revised upward from earlier estimates — and then to about 820 million in 2025, an 8% decline. Over the same period the number of publicly reported attacks rose. The contradiction resolves once you look at the payment rate: 28% of victims paid in 2025, a record low, and Coveware's 2026 caseload is running at 23%. Verizon's 2026 breach data puts refusal at 69%; other trackers put it between 72% and 77%. More attacks, fewer buyers.

The demand side of the ledger is just as slippery, and most reporting conflates two different numbers. Chainalysis measured a median payment of 59,556 dollars in 2025 — up 368%, which sounds alarming until you notice it is a median across a shrinking pool of payers. Sophos, surveying a different population, puts the 2026 median payment at 769,000 dollars, down from about a million the year before. Average initial demand in the third quarter of 2026 was 602,400 dollars. A median payment in the tens of thousands and an average demand in the hundreds of thousands are not contradictory; they describe a market where most victims pay nothing at all. Any single figure quoted without its denominator is a story, not a measurement.

Why Extortion Stopped Working

The decline has several causes and they reinforce each other. Backup and recovery discipline improved enough that restoring became a credible alternative to paying, which is exactly what a decade of immutable-backup advice was meant to achieve. Insurers tightened which incidents they would fund a payment for. Law enforcement disruption campaigns raised the operational cost of running a criminal enterprise, and sanctions exposure made facilitating payments legally hazardous for the advisers involved. Underneath all of it sits a lesson chief financial officers learned the hard way: paying does not buy a clean recovery. It buys a promise from a criminal, and frequently a second demand.

What did not happen is a decline in ambition. The third quarter of 2026 was the highest-volume quarter on record: 2,627 claimed attacks, up 29% on the previous quarter and 61% year on year, according to Comparitech's tracking. Qilin and The Gentlemen dominate the leak-site rankings, and Clop — the group behind the MOVEit campaign — returned with dozens of claimed victims in a single quarter, a reminder that established operators can re-enter at scale whenever a new file-transfer flaw appears.

The Pivot: Steal, Threaten, Skip the Lock Icon

Criminal groups did not exit the market; they changed product. Pure data extortion removes the part of the operation with the worst risk-reward ratio — reliable encryption across heterogeneous environments, key management, and the decryption support process that generated so much friction and bad press. Instead the operator steals data, proves the theft with samples, and threatens publication or regulatory exposure. It is faster, cheaper, and requires no decryption infrastructure at all. Regulated sectors are the softest targets, because the cost of disclosure, notification, fines, and litigation can dwarf a ransom demand, which lets the attacker price high without ever touching production systems.

The escalation of 2026 is triple extortion, documented in the MIP Holdings case: encrypt what you can, steal what you can, then add a third pressure point — customers, partners, or regulators contacted directly. Each layer is cheap once the intrusion is complete, and each one raises the cost of refusing. A related evolution is the pursuit of third parties — processors, vendors, and service providers whose compromise yields leverage over many downstream victims at once.

The Machines Are Now Doing It

In July 2026, researchers reported JadePuffer, the first ransomware campaign observed running end to end with AI doing the operational work — reconnaissance, target selection, and the extortion correspondence. The public technical detail is thin, and one campaign name is not a trend. But the economic logic is uncomfortable: the expensive part of extortion was always labour, and labour is now the part that scales without hiring. If the cost of running a campaign falls by an order of magnitude, the payment rate can stay at 23% and the total revenue still grows.

Why Backups Are No Longer an Answer

This is the strategic consequence most organisations have not internalized. If the loss event is a leak rather than an outage, then a pristine, immutable, tested backup restores availability and leaves the actual problem completely untouched. The question an executive team must be able to answer changes from how fast can we recover to what did they take, and what does it cost us if it appears publicly. That shifts investment toward a different set of controls: data minimization, so that sensitive records do not accumulate beyond their operational need; classification, so you know what a leak would actually contain; and egress monitoring, because exfiltration requires volume moving somewhere unusual, and large transfers to unfamiliar cloud storage are detectable if anyone is watching.

It also changes where the initial access comes from. IBM's 2026 estimate attributes roughly 15% of breaches to the supply chain, at an average cost near five million dollars — and a compromised vendor is valuable precisely because it holds data belonging to many clients at once. The victim's own backup posture is irrelevant to a breach that began in someone else's environment.

Education Learned This First

The Instructure/Canvas incident is the clearest illustration of the thesis in 2026: ShinyHunters claimed 3.65 terabytes covering 275 million users at a platform Instructure says serves more than 30 million people, exams disrupted, and the leverage applied through institutional embarrassment rather than locked systems. Schools combine every attribute extortionists want — large stores of personal data on minors, thin security budgets, mandatory disclosure duties, and a constituency that reacts strongly to publication. Expect the playbook to be repeated wherever those four conditions hold: healthcare providers, municipal services, and membership organisations.

Rehearse the Extortion Decision

• Decide policy before the incident: Who has authority to refuse or engage, under what sanctions and legal constraints, and with what pre-agreed communication posture? A decision made in hour six will be the worst one you make all year.
• Assume the leak is the deadline: Disclosure clocks run on your schedule, not the attacker's, and the data may already be staged for release.
• Know what you actually hold: Classification and retention limits convert an unbounded threat into a bounded one. You cannot triage a leak you cannot describe.
• Preserve evidence deliberately: Extortion negotiations and data theft are investigations, and hasty remediation can destroy the trail.
• Plan for customers, not just regulators: Notification obligations extend outward, and the leak's second-order cost is usually reputational.

Ransomware has not disappeared and backups remain essential; a locked-out business is still a business in crisis. But the loss model migrated from availability to confidentiality while most defensive narratives stayed behind. The industry spent a decade engineering for the padlock on the file. The extortionists moved to the folder that holds it.