Research: in 2019, payments to release files from ransomware attacks averaged ~$84K in Q4, more than double the Q3 average, and jumping to $191K in December
Nathaniel Popper / New York Times :
Context & Ripple Effects
This early-2020 research captured ransomware mid-metamorphosis: average payments to unlock files more than doubled quarter-over-quarter to about $84K in Q4 2019, hitting $191K by December — a sharp break from the small-dollar, spray-and-pray extortion documented when a Google study tallied just $25M paid over two years.
First-order effects
- Victims closing out attacks at year-end 2019 faced demands on a new scale, with December's $191K average signaling attackers had learned they could charge far more per incident than the Q3 norm.
Second-order effects
- Rising per-victim payouts made hunting larger, better-insured targets rational, feeding the escalation that pushed ransomware payments to a record $1.1B in 2023 after annual totals climbed from $567M in 2022.
Third-order effects
- The same escalation eventually priced itself out: by 2024 attackers collected ~$813.55M, down 35% from 2023's peak, as more victims refused to pay — suggesting the big-game model peaks and erodes once defenses and nonpayment norms catch up.
The trend: Ransomware evolved from low-value mass extortion into high-stakes big-game hunting, with aggregate payments peaking in 2023 before victim refusal began shrinking the market.