US Treasury says there was $590M in suspicious activity related to ransomware in H1 2021, exceeding the entire amount in 2020, when $416M was reported
Suspicious activity reports related to ransomware jumped significantly in 2021, according to the U.S. Treasury Department's Financial Crimes Enforcement Network.
Context & Ripple Effects
FinCEN’s H1 figure was corroborated days later by a Treasury report describing financial firms’ roughly $600M in flagged suspected ransomware payments. It became an early marker of a larger 2021 increase: FinCEN later put likely ransomware payments for the full year at about $1.2B.
The later record in 2023 and payment decline in 2024 show that the H1 surge was part of a volatile ransomware-payment cycle, not a steady upward line.
First-order effects
- Financial firms had identified $590M in ransomware-linked suspicious activity by mid-2021, giving FinCEN a reported total already above all of 2020’s $416M.
- The Treasury’s reporting placed ransomware payments more squarely within the financial-sector monitoring system rather than treating them solely as a cybersecurity incident metric.
Second-order effects
- The H1 signal was followed by a full-year estimate of roughly $1.2B in likely 2021 payments, increasing the pressure on financial institutions to identify ransomware-linked flows as volumes rose.
- Ransomware groups’ revenue model became more exposed to reporting by regulated intermediaries, while victims’ payment decisions increasingly shaped the measured market.
Third-order effects
- Ransomware is becoming a financial-crime enforcement problem as well as a cyberattack problem, with suspicious-activity reporting providing a recurring measure of payment flows.
- The subsequent 2023 payment record and 2024 decline as more victims refused to pay indicate that reported ransomware revenue can swing sharply with victim behavior, even after monitoring becomes more established.
The trend: Ransomware response is shifting toward sustained financial-flow visibility and enforcement, while payment totals remain driven by the changing willingness of victims to pay.