Cisco cybersecurity report: 9.5K ransomware victims pay ransoms each month, the average ransom is about $300, generating up to $34M a year for hackers
Context & Ripple Effects
Cisco's 2016 security report put hard numbers on ransomware as a volume business: roughly 9,500 victims a month paying an average of about $300 each, up to $34M a year flowing to attackers. At the time, that framed ransomware as a mass-market extortion model priced like consumer software.
The subsequent coverage shows how quickly that model broke upward: Google researchers counted $25M+ paid over two years, 2019 quarterly averages climbed past $84K and hit $191K in December, and by Q1 2021 the average payment reached $220,298. The story of ransomware since this report is the migration from thousands of small payments to fewer, far larger ones.
First-order effects
- Victims face a working market with a set price point: at ~$300, paying is cheaper than most recovery efforts, which is exactly what sustains the 9,500 monthly payers Cisco counts.
Second-order effects
- Attackers' success rate invites targeting richer victims — the same corpus later records average demands jumping 47% and ransomware becoming 41% of cyber insurance claims filed in H1 2020, pulling insurers directly into ransom negotiations.
Third-order effects
- If the pricing trajectory holds — from Cisco's ~$300 average to Coveware's $220,298 average by Q1 2021 — ransomware restructures from opportunistic consumer-grade crime into negotiated corporate extortion, with insurers and negotiators as standing intermediaries.
The trend: Ransomware is shifting from high-volume, low-price attacks on individuals toward large-dollar extortions of insured organizations, with average payments rising three orders of magnitude across the covered period.