Ransomware victims are paying less often in Coveware’s observed cases, but that does not prove criminals’ total profits are falling. Coveware recorded a 23% payment rate in Q3 2025, down from 28% in Q1 2024. Yet later data show that payment amounts can swing sharply, while a separate estimate found ransomware-group revenue rose year over year. The evidence supports a narrower conclusion: fewer victims are paying, but payment amounts and estimated revenue do not move in lockstep, and the available figures do not establish criminals’ net profit.
What the report actually found
Coveware’s Q3 2025 incident-response data showed that 23% of observed ransomware victims paid, compared with 28% in Q1 2024. That is a five-percentage-point decline in the share paying—not a direct measure of total criminal income or profit. Coveware’s cases are not a census of all ransomware incidents.
Payment size also needs careful reading. For Q3 2025, Coveware reported an average payment of $376,941, down 66% from Q2, and a median payment of $140,000, down 65% from Q2. The average is the arithmetic mean and can be pulled upward by a small number of large payments; the median is the midpoint, with half of recorded payments above it and half below. They describe different things.
The distinction matters because the headline phrase “profits declining” can sound more conclusive than these figures allow. A victim’s ransom payment is revenue to an attacker before operating costs and any division of proceeds among affiliates or other participants. Coveware did not publish an audited series of ransomware groups’ net profits.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Why later payment figures complicate the trend
Coveware by Veeam’s later quarterly figures show why a falling payment rate should not be treated as a steady decline in the amount criminals collect per case.
| Period | Payment rate | Average payment | Median payment |
|---|---|---|---|
| Q3 2025 | 23% | $376,941 | $140,000 |
| Q1 2026 | 23% | $680,081 | $300,750 |
| Q2 2026 | New record low; exact rate not stated in the cited update | $1,880,612, up 176% from Q1 | $150,000, down 50% from Q1 |
The Q2 2026 figures moved in opposite directions: the average more than doubled from Q1, while the median halved. Coveware attributed the unusually high average to a handful of large data-exfiltration payments, including targeted cases against law firms. That pattern is a reminder that a few exceptional cases can change the mean without changing the typical case in the same way. The payment rate reached a new record low, but the cited update does not state the exact percentage.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Does this mean ransomware groups’ total revenue is falling?
Not necessarily. Rapid7 estimated that ransomware groups generated $529.2 million in revenue in Q1 2026, 39% more than in Q1 2025, according to TechRadar Pro’s report. That is a separate estimate of aggregate group revenue, not a Coveware average or median payment. The figures use different methods and populations, so they cannot be compared as if they measured the same thing.
Nor is estimated revenue the same as net profit. A group’s proceeds may be divided among affiliates and other participants, and operations have costs. Without consistent accounting for those expenses and revenue across the ecosystem, the cited statistics do not settle whether ransomware criminals’ total net profits are declining.
Recommended Free Tools
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Why fewer victims may be paying
Coveware interprets falling payment rates and thinner margins as pressure on the ransomware business model. It points to the costs of paying affiliates, buying access through brokers, storing stolen data, harassing victims, and maintaining leak sites. It also describes a shift toward more selective or creative tactics, including targeted social engineering and insider approaches.
That is Coveware’s analysis of changing criminal operations, not independently verified margin accounting. It offers a plausible explanation for why attackers may adapt when fewer victims pay, but it does not quantify the costs or prove how much any group earns after expenses.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What to take from the figures
- Payment frequency: Coveware observed a lower share of victims paying in Q3 2025 than in Q1 2024. The result applies to its cases, not every ransomware victim.
- Payment size: Average and median amounts can diverge, particularly when a small number of unusually large cases affect the average.
- Total revenue: Rapid7’s Q1 2026 estimate rose year over year, but it measures something different from Coveware’s case-level payment figures.
- Profit: None of these figures provides a comprehensive, audited measure of net profit across ransomware groups.
The evidence therefore supports a qualified reading of the headline: victims paid less often in Coveware’s observed cases, but the data do not establish a general decline in ransomware profits. Payment amounts and revenue estimates are volatile, and the measures answer different questions.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Sources
- CSO Online: “Report: Profits from ransomware attacks declining” (Oct. 30, 2025)
- Coveware: “Insider Threats Loom while Ransom Payment Rates Plummet” (Oct. 24, 2025)
- Coveware by Veeam quarterly reports
- TechRadar Pro: Rapid7’s Q1 2026 ransomware revenue estimate (June 2, 2026)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
