Short answer: The roughly $1,000 figure was a real 2017-era statistic, but it was not a permanent average ransom demand. CyberScoop, citing Symantec research on 2016 activity, reported that an attack yielded an average of $1,077—up 266% from the prior year. That measure is different from an opening demand, a negotiated payment, or the total cost of recovering from an attack.
Victims’ willingness to pay helped prove that ransomware could be profitable. In 2026, however, serious business attacks are commonly targeted, negotiated and tied to data theft and downtime. Recent Sophos surveys report enterprise demands and payments in the hundreds of thousands or millions, while small commodity campaigns still exist.
What the original $1,077 claim actually measured
The headline came from a CyberScoop report published April 26, 2017, about Symantec research into 2016 ransomware. It described an average “yield” of $1,077 per attack, a 266% year-over-year increase. “Yield” means the attacker’s revenue or expected return across attacks; it does not necessarily mean that every victim received a $1,077 opening demand.
These terms are not interchangeable:
- Ransom demand: the amount initially requested.
- Ransom payment: what the victim ultimately transfers, often after negotiation.
- Yield: the attacker’s revenue or expected return across victims.
- Average: the arithmetic mean, which can be pulled upward by a few large payments.
- Median: the middle result, often more representative when payments are highly uneven.
- Recovery cost: downtime, restoration, forensic work, legal fees, lost productivity and other expenses beyond any ransom.
The historical report also cited a 34% global payment rate and a 64% U.S. rate, while saying only 47% of paying victims recovered their files. Those were older Norton/Symantec figures, not a current universal rate. CyberScoop also mentioned a reported $28,000 payment by a Los Angeles college and an IBM Security survey in which more than half of surveyed businesses had paid over $10,000 and 20% had paid over $40,000. Those studies covered different populations and should not be treated as one dataset. CyberScoop’s 2017 report
#1 Best Overall
Why payment made ransomware profitable
A criminal does not need every victim to pay when the cost of distributing malware is low. A meaningful conversion rate can produce a strong return, especially when payment is collected through cryptocurrency and attacks can be automated.
Paying victims also supplied information that improved the business model:
- Operational disruption created pressure to restore access quickly.
- Weak or untested backups made payment appear cheaper than rebuilding.
- Attackers could adjust demands to a victim’s apparent ability to pay.
- Ransomware-as-a-service and ready-made kits lowered the technical barrier for affiliates.
- Later “double-extortion” campaigns added threats to publish stolen data, not just decrypt locked files.
The 34% payment figure was evidence of attractive conversion, not proof that payment alone caused prices to rise. Victim size, downtime, data sensitivity, insurance, negotiation and criminal specialization also affect price. An historical discussion of ransomware-as-a-service and recovery risk is available from Allens.
How ransomware changed from commodity malware to targeted extortion
Earlier, mass-market ransomware
- Broad distribution to home users and small organizations.
- Automated infections and relatively fixed, low-dollar demands.
- Volume mattered more than detailed knowledge of one victim.
- Bitcoin or similar currencies were commonly requested.
Modern targeted attacks
- Initial access may come from exploited vulnerabilities, stolen credentials, phishing or remote-access tools.
- Operators can spend days or weeks mapping a network before encrypting systems.
- Data may be copied before encryption, creating a separate leak threat.
- Demands are tailored to revenue, insurance, operational dependence and sensitive information.
- Negotiators, deadlines, customer-notification threats and repeat extortion are common pressure tactics.
That is why a consumer-era average cannot be compared directly with a modern enterprise median.
Rank #3
What recent ransomware figures show
Sophos’s 2025 State of Ransomware survey covered 3,400 IT and cybersecurity professionals in 17 countries. Its headline reported a $1 million average ransom payment and a $1.5 million average recovery cost. It also found that 53% paid less than the initial demand and 18% paid more. This is a vendor-sponsored survey, not a census of every victim. Sophos State of Ransomware 2025
| Measure | Reported result | Scope and caveat |
|---|---|---|
| Average payment | $1 million | Sophos 2025 survey headline; average, not median |
| Average recovery cost | $1.5 million | Sophos 2025 survey; includes costs beyond ransom |
| Enterprise median demand | $1.20 million | Sophos enterprise analysis for 2025 |
| Enterprise median payment | $1 million | Sophos enterprise analysis for 2025 |
| Organizations paying | 48% | Affected enterprises in the 2025 analysis |
| Median demand | $698,000 | Sophos 2026 summary |
| Median payment | $769,000 | Sophos 2026 summary; publication dated July 2026 |
The 2025 enterprise analysis also reported that only 53% used backups to restore data. The 2026 summary said 48% of organizations whose data was encrypted paid and that more than half recovered within one week. These figures describe surveyed organizations that experienced ransomware; they do not mean every victim faces a multimillion-dollar demand. See Sophos’s enterprise analysis and its 2026 summary.
Why the opening demand is rarely the final price
- Attackers estimate the organization’s ability to pay and set an anchor.
- The victim checks backups, insurance, legal exposure and the cost of downtime.
- The victim or a specialist negotiator makes a counteroffer.
- Attackers may discount, raise pressure, change deadlines or request separate payment for stolen-data suppression.
- The organization decides whether payment, restoration or rebuilding presents the lower overall risk.
Sophos reported that 53% paid less than the initial demand, with negotiation accounting for most reductions. Some victims pay more than the opening figure when additional systems or data are involved. Sophos’s 2025 press release
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does paying guarantee recovery?
No. A decryptor may be missing, defective or too slow; files may already be damaged; backups may remain compromised; and stolen data can still be published after payment. Criminals can also return for a second payment or reinfect systems. The historical 47% recovery figure should not be generalized to current enterprise incidents, but it illustrates why a transfer is not the same as restoration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The true financial comparison includes lost sales, payroll and production disruption, forensic investigation, infrastructure replacement, customer notification, regulatory response, legal work and reputational damage. Refusing to pay does not make those costs disappear, but paying does not eliminate them either.
Best Value
What U.S. authorities recommend
The FBI says it does not support paying a ransom, while recognizing that organizations may face difficult circumstances. It asks victims to report the ransomware variant, amount, cryptocurrency address, attacker contact details and whether payment was made. That is guidance, not a blanket U.S. legal ban; sanctions, jurisdiction, sector rules and the identity of the recipient can create legal risk. Consult counsel before any transaction. FBI/IC3 ransomware guidance
CISA recommends preparation, incident reporting, endpoint detection, application controls and resilient backups that are encrypted, isolated or immutable and regularly tested. CISA’s #StopRansomware Guide
If ransomware hits: a practical response sequence
- Isolate affected systems. Disconnect networks, shared drives and cloud synchronization without shutting down systems unnecessarily.
- Preserve evidence. Keep ransom notes, logs, email headers, timestamps, wallet addresses and indicators of compromise.
- Activate the response plan. Involve executives, IT, legal, insurers and qualified incident responders.
- Report the incident. Contact law enforcement, including IC3 in the United States.
- Check backups safely. Determine whether attackers accessed, deleted, encrypted or poisoned them.
- Determine whether data was stolen. A decryptor cannot solve a data-leak threat.
- Close initial access. Reset credentials, remove unauthorized tools and patch the exploited path before restoration.
- Assess payment legally and operationally. Check sanctions, notification duties, insurance conditions and the realistic cost of rebuilding.
- Restore from clean backups and monitor. Validate systems, watch for reinfection and document decisions.
How to evaluate any ransomware statistic
- Ask whether it measures a demand, negotiated payment, actual transfer, yield or total recovery cost.
- Prefer a median when a few large incidents can distort an average.
- Check whether the population is consumers, small businesses, enterprises, healthcare or government.
- Separate reporting year from publication year and check currency and inflation.
- Look for vendor sponsorship, anonymous-survey limitations and whether only reported victims were included.
- Check whether extortion-only incidents are counted alongside encryption.
The Bottom Line
The $1,077 figure was a genuine 2016 estimate of ransomware yield reported in 2017. It showed that enough victims paid to make low-cost ransomware profitable, not that ransom demands would remain near $1,000. Modern targeted extortion prices depend on the victim, data, downtime, negotiation and recovery options; resilience and tested backups matter more than any single “average ransom.”
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
