Free tools Windows power users keep installed
One-click scans. No signup required.
Coveware reported that 23% of ransomware incidents in its Q3 2025 incident-response sample resulted in a payment, a record low in its series. Its average and median payments also fell from the previous quarter. Those findings describe what happened in Coveware’s observed cases—not a global count of victims or proof that ransomware attacks declined.
What Coveware reported for Q3 2025
Coveware’s report, published October 24, 2025, measured how often organizations in its incident-response cases paid and how much they paid. Its figures cover observed cases, not every ransomware incident worldwide.
| Measure | Q3 2025 result | What it describes |
|---|---|---|
| Payment rate across impact scenarios | 23% — a historical low in Coveware’s series | Share of observed cases involving encryption, data exfiltration, or other extortion that ended in payment |
| Data-exfiltration-only payment rate | 19% — a record low in Coveware’s series | Share of observed data-exfiltration-only cases that ended in payment |
| Average payment | $376,941, down 66% from Q2 2025 | Mean amount paid in Coveware’s observed cases |
| Median payment | $140,000, down 65% from Q2 2025 | Middle payment amount in Coveware’s observed cases |
| Cases with exfiltration observed | 76% | Share of Coveware’s Q3 cases in which data exfiltration was observed |
| Cases with lateral movement observed | 73% | Share of Coveware’s Q3 cases in which lateral movement was observed |
Coveware described the 23% result as a historical low across encryption, data-exfiltration, and other extortion scenarios. Its report is the primary source for these figures: Coveware’s Q3 2025 ransomware report.
Why payment frequency and payment size are different stories
The payment rate answers how often a payment occurred in the observed cases. The average and median answer how large those payments were. A lower rate does not itself explain the decline in dollars, and falling payment amounts do not show that fewer attacks happened.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Coveware attributes the lower amounts in its dataset to two shifts: larger enterprises increasingly resisting payment, including in data-exfiltration campaigns, and a greater mix of mid-market attacks with lower demands. That is Coveware’s interpretation of its cases, not an independently established causal explanation. The average can also be pulled upward by a relatively small number of large payments, which is why the median provides a useful separate measure.
Does this mean ransomware attacks declined?
No such conclusion follows from a payment rate. It measures outcomes among a particular incident-response sample, not the total number of attacks. Other Q3 reporting continued to show ransomware activity, but counted different things—such as publicly claimed victims, monitored leak-site posts, or incidents investigated by another organization.
Rank #2
- SuperSpeed: A super-fast 64GB USB3.0 USB drive with read speed up to 150MB/S and write speed up to 80MB/S. It has super speed but DOESN'T overheat. Also available in a 128GB capacity. See the A+ comparison chart for details.
- Safety: It comes with A physical write-protect switch and can safely connect to any computer while the switch set to “Read-Only”. In the Protected mode, your data is safe from viruses, malware, data tampering and accidental deletion.
- High Endurance: This flash drive has higher performance and endurance/durability as it adopts A+ MLC memory chip compared with other USB flash drives which use TLC or QLC chips.
- Capacity: This listing is for the 64GB version. A 128GB option is also available. See the A+ comparison chart for details.
- Plug and Play: Simply plug the thumb drive into any USB port and then start data transfer and storage. It is compatible with USB 3.0/3.1 and USB 2.0 ports and works on Windows2000/XP/Vista/7/8/10/11/Server, Mac OS, and Linux. The default format is exFAT file system which allows individual files larger than 4 GB, but you can always re-format to FAT32.
Check Point Research’s November 13, 2025 report discusses Q3 actors, publicly claimed victims, and a fragmented ransomware ecosystem: Check Point Research’s Q3 ransomware analysis. Beazley Security’s Q3 report tracks its monitored activity and warns that leak-site data omits incidents and can lag while negotiations or delayed disclosures unfold: Beazley Security’s Q3 2025 report.
These reports can show active threats alongside fewer payments in Coveware’s sample because the measures have different denominators. A public victim claim is not necessarily a verified incident, and a leak-site post is not a count of all attacks or of payments. Geography and coverage also depend on each publisher’s dataset; the figures cited here do not establish a worldwide attack total.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Why a low payment rate matters to organizations
Coveware’s figures suggest that fewer organizations in its sample paid, including in data-exfiltration-only cases. But the 19% figure also shows that payment remained an outcome in some such incidents. An organization may face separate risks: encryption disrupting operations and stolen information being disclosed. Restoring systems from backups may address the first risk without preventing the second.
Coveware reports attackers manipulating or deleting backup infrastructure to increase pressure. Beazley describes extortion demands tied both to decryption and to promises about stolen data. Offline backups and tested incident plans can help improve recovery readiness, but backups do not prevent data theft or guarantee that attackers will not publish stolen information.
Rank #4
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Why FinCEN’s payment figures are not a direct comparison
FinCEN’s figures come from Bank Secrecy Act reports, not Coveware’s incident-response case sample. In its December 4, 2025 release, FinCEN reported $734 million in aggregate payments across 1,476 incidents in 2024 and said its analysis organizes events by incident date. That annual, report-based total cannot be compared directly with Coveware’s Q3 2025 average, median, or payment rate: the period, data source, and measure differ.
See FinCEN’s ransomware trends report for 2022–2024 for the agency’s method and figures.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
