The State of Ransomware 2026: Payments are dropping but encryption is climbing
Summary
A recent report indicates that while organizations are paying less in ransomware demands, the use of encryption by attackers is on the rise. This trend suggests a shift in attacker tactics, potentially focusing on data exfiltration and disruption over direct financial gain from ransoms.
IFF Assessment
The increasing use of encryption by ransomware attackers, even as ransom payments decrease, indicates a potentially more damaging and disruptive threat to organizations.
Defender Context
Defenders should be aware that ransomware is evolving, and the reduction in ransom payments doesn't necessarily mean a decrease in impact. Organizations need to focus on robust data backup and recovery strategies, as well as comprehensive incident response plans, to mitigate the effects of encryption and potential data exfiltration.