Ransomware Just Had Its Biggest Year on Record - Even as Payments Fall

Ransomware disclosures hit a new high for the fourth straight year: Black Kite tracked 7,551 publicly disclosed victims between April 2025 and March 2026, a 24.9% increase on the prior period. Sixty-one new ransomware groups entered the market over the same window - more than one a week - bringing the number of active groups to roughly 146 by mid-2026. Verizon's 2026 Data Breach Investigations Report found ransomware present in 48% of all breaches, up from 44% the year before.

The financial picture is more complicated than "getting worse"

Despite record attack volume, the median ransom demand fell to roughly $698,000 (down from $1.32 million in 2025 and $2 million in 2024), and the median payment dropped to about $769,000. That's a genuine sign that more victims are refusing to pay - but it comes with a catch: the average cost to recover from an attack, excluding any ransom, rose 11% to about $1.7 million. Attackers are compensating for lower payment rates with more victims and heavier multi-extortion tactics - encryption plus data theft plus DDoS plus direct client harassment, layered to force payment even when backups exist.

What's driving initial access

Identity compromise is now the leading delivery mechanism for ransomware: malicious email (26%) and phishing (24%) together account for half of all root causes. AI-assisted phishing content is a large part of why - it's measurably harder for staff to spot than the templated phishing of a few years ago.

What this means for Gaming, Fintech, and Insurance security leaders

• Backups alone no longer neutralise ransomware risk - multi-extortion means data theft and client-facing pressure happen regardless of whether you can restore from backup.
• Phishing-resistant authentication (FIDO2-based MFA, not just any MFA) is the highest-leverage control against the current dominant entry vector.
• Budget for recovery cost, not just ransom cost, when modelling ransomware exposure - the $1.7 million average recovery figure is what boards should be sizing insurance and incident response retainers against.