New Proofpoint survey data confirms that a significant share of organisations that pay ransoms face further extortion, while Operation Cronos showed criminals routinely keep stolen data regardless.
Summary
- 58% of affected UK organisations paid a ransom; 22% of those who paid were extorted again.
- Globally, 54% of victims paid, ranging from 19% in Japan to 93% in the US.
- Operation Cronos confirmed that ransomware operators retain victim data even after payment.
- 2% of victims who paid never recovered their files at all.
- AI is sharpening the phishing, BEC, and credential-theft campaigns that precede ransomware, though it has not yet materially changed ransomware payloads themselves.
The recidivism problem
Proofpoint’s latest survey data makes the case plainly: paying a ransom does not close the incident. In the UK, 22 percent of organisations that paid were subsequently extorted again. The global repeat-extortion rate sits at 37 percent, meaning more than one in three paying victims found themselves back at the negotiating table. UK organisations fared marginally better than that average, but the principle holds regardless of geography — once an attacker knows an organisation will pay, the organisation becomes a proven revenue source.
Regional variation is wide, but the underlying dynamic is not
Payment rates swing considerably by market. Japan sits at 19 percent; the United States at 93 percent. Proofpoint attributes the spread to regulatory environment, recovery capability, insurance incentive structures, and cultural norms around negotiation. Despite that variation, the firm notes the core finding holds across every surveyed market: ransomware generates enough operational and reputational pressure that a meaningful share of organisations in each region choose to pay. The payment decision is a product of circumstance as much as strategy.
Operation Cronos settled a long-standing question
Law enforcement’s takedown of LockBit, known as Operation Cronos, moved a previously reasonable assumption into the category of established fact: ransomware operators commonly retain victim data after receiving payment. Before the infrastructure behind Dmitry Khoroshev’s operation was dismantled, this was an inference drawn from behaviour patterns. Cronos provided direct evidence. The implication for CISOs is significant — paying does not restore the status quo. The stolen data remains outside the organisation’s control, and the threat of publication persists regardless of whether decryption keys are handed over.
Decryptors fail more often than reported
Even when attackers do provide decryption tools, recovery is not guaranteed. Proofpoint found that 2 percent of victims who paid never recovered their files. Earlier this year, victims of Nitrogen’s ESXi ransomware encountered a separate failure mode: a coding error in the decryptor left some unable to fully restore access. These are not rare edge cases. Ransomware operators have no contractual obligation and no reputational incentive to ensure their tools work correctly. Paying is a bet on a counterparty with every structural reason to behave badly.
AI’s role: precursor, not payload
Consistent with several recent industry reports, Proofpoint found that AI is influencing the attack chain — but not yet in ransomware payloads themselves. In the UK, 65 percent of surveyed security practitioners said AI had sharpened the attacks that precede ransomware, most notably malicious links, business email compromise, malicious attachments, and credential harvesting. Ryan Kalember, Proofpoint’s chief strategy officer, put it directly: ‘AI hasn’t fundamentally changed ransomware, but it has materially improved the attacks that lead to it.’ He added that attackers are using AI to produce convincing phishing emails and credential-theft campaigns that exploit human trust at scale. The practical implication is that the entry point for most ransomware incidents remains people and identities, not technical vulnerabilities in backup or endpoint systems.
Resilience over ransom
The accumulated evidence points toward a consistent conclusion: the organisations best positioned after a ransomware incident are those that do not depend on the attacker’s cooperation for recovery. That means offline and tested backups, documented and rehearsed recovery procedures, and investment in the phishing and identity-based attack surfaces where these campaigns most frequently begin. Paying transfers money and, potentially, information about the victim’s willingness to pay again. It does not transfer control back to the victim.
Why it matters
For CISOs, this data reframes the ransom-payment question as a governance and risk-quantification issue, not merely an ethical one. Paying exposes the organisation to repeat extortion, does not guarantee data deletion or working decryption, and signals to the threat actor community that the organisation is a viable target. With 65% of UK security practitioners reporting AI-enhanced precursor attacks, the relevant investment decision is not how to respond to ransomware but how to reduce the probability of initial compromise — particularly across email, identity, and human-layer controls.
What to do now
- Test backup and recovery procedures regularly to ensure recovery does not depend on obtaining a working decryptor from the attacker.
- Brief the board on the repeat-extortion rate: paying a ransom does not guarantee the incident is closed, as supported by both Proofpoint’s survey data and findings from Operation Cronos.
- Review insurance policy terms for any clauses that create payment incentives, given Proofpoint’s observation that insurance incentive structures influence regional payment rates.
- Prioritise controls at the human and identity layer — phishing, BEC, and credential harvesting — given Proofpoint’s finding that these are the primary AI-enhanced precursors to ransomware.
- Ensure incident response plans address the possibility that stolen data is retained by attackers regardless of whether a ransom is paid.
