For an extended period, ransomware groups have instilled fear in various organizations, including businesses, schools, and hospitals. However, there is a positive shift as an increasing number of victims are now rejecting ransom demands.

In the fourth quarter, the percentage of victims succumbing to ransom payments reached an all-time low, standing at a mere 29%, according to cybersecurity provider Coveware, specializing in assisting companies against ransomware attacks. 

This decline is not an isolated incident but part of a growing trend that commenced approximately three years ago when around 60% of victims yielded to ransomware demands. Coveware attributes this change to the enhanced capabilities of the industry in responding to successful ransomware incidents. Despite these attacks having the potential to encrypt entire networks and pilfer sensitive information, many companies are now able to recover using their own backups.

Moreover, there is a heightened awareness among victims that paying a ransom provides no assurance of data deletion. Instead, there is a risk that the stolen data might be traded clandestinely to other cybercriminal groups, and the ransomware gang could exploit the information to target the victim again.

Coveware notes, "The industry continues to get smarter on what can and cannot be reasonably obtained with a ransom payment. This has led to better guidance to victims and fewer payments for intangible assurances." 

However, on the downside, ransomware groups are still extracting substantial funds from those who choose to pay up. In Q4, the average ransomware payment soared to $568,705, up from $408,644 a year earlier. Simultaneously, the number of data breaches in 2023 set a new record at 3,205 publicly known compromises, as reported by the Identity Theft Resource Center.

Coveware emphasizes the need for a united front against the ransomware menace, urging the industry to establish stronger collaborations with law enforcement on a continuous basis rather than seeking assistance only during a ransomware attack. 

The company highlights that less than 10% of victims contacted by law enforcement for further assistance in the aftermath of a ransomware incident actually continue to collaborate. This lack of follow-through impedes law enforcement efforts, as proper evidence collection from victims is crucial to concluding investigations. Coveware's data reveals that the majority of ransomware victims are small to medium-sized businesses with employee headcounts below 1,000 people.