Paying a ransom doesn’t stop cybercriminals: report

Sponsored by

AI agents are starting to do more than access systems. They can invoke tools, execute workflows, and take action across business applications. As that autonomy grows, IT needs visibility into what each agent is allowed to do, what it actually did, who owns it, and how to revoke access when needed. Learn how JumpCloud helps govern AI agents alongside human and device identities.

If you give a mouse a cookie, he’s going to ask for a glass of milk. And if you pay a cybercriminal a ransom, they’ll come back for more money.

That’s according to a July Proofpoint report, based on a survey of 953 security pros from 12 countries, in which 54% of global organizations reported paying a ransom in the last year to regain access to their data following an attack. US organizations had the highest ransom payment rate, with 93% of affected organizations admitting to coughing up money to hackers. (Proofpoint noted that the US also had the highest incident rate among examined markets.)

However, paying the ransom didn’t close out the situation for many organizations. While 56% of companies that paid one ransom regained access to their data, more than one-third (37%) said they were burdened with a second extortion demand.

“What the data tells us is that ransomware has evolved beyond a single transactional event where paying attackers restores normal operations,” the report wrote. “It now functions as an ongoing negotiation in which attackers hold multiple forms of leverage at the same time: continued encryption, stolen data, and the threat of public disclosure.”

Hot topic. Whether or not a company should pay a ransom demand is a hot topic of discussion within the industry. Some cybersecurity pros are against payouts, thinking they incentivize future attacks and don’t guarantee data recovery, and some countries have attempted to find avenues to prevent companies from giving money to malicious actors. In 2025, the UK proposed a ban that would prohibit the National Health Service (NHS), schools, and local councils from paying ransom demands.

However, others remain more understanding about the need to pay ransoms. Mike Puglia, GM of cybersecurity labs at Kaseya, told IT Brew in February that the risk of downtime can sometimes outweigh the financial blow, especially for healthcare institutions: “It is disgusting that hospitals and places like that, where they have a high degree of payouts, that they go after them, but there is no coming back from that if people are injured or dead.”