Chainanalysis
6 stats1 reports
Reports
All Statistics
Data leak site-claimed ransomware incidents grew by 50% YoY — an all-time high.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
Data Leak SitesRansomware
The United States remains the most heavily targeted jurisdiction in leak site activity, followed by Canada, Germany, the UK, and other parts of Europe.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
Data Leak SitesUSCanadaGermanyUK
On-chain analysis indicates that spikes in IAB inflows typically precede increases in ransomware payments and victim leaks by roughly 30 days.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
IABRansomwareRansom PaymentVictim Leaks
The median ransom payment grew 368% year-over-year to nearly $60,000.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
RansomwareRansom Payment
Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
On-Chain Ransomware PaymentsRansomware
Manufacturing and finance/professional services were the most heavily compromised in leak site activity.
ChainanalysisTotal Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate·7mo ago
Data Leak SitesManufacturingFinanceProfessional Services