Initial ransom demands surged by almost half last year, according to the latest figures from Coalition, but despite hackers piling on the pressure, more firms than ever are refusing to bend the knee.

The cyber insurer’s 2026 Cyber Claims Report found that ransom demands exploded 47% year-over-year, hitting an average of just over $1 million – but while some firms were extorted for as little as $9,000, Coalition saw other demands reach as high as $16 million.

The report found a huge disparity in the payouts demanded by different ransomware operators. Akira, for example, was linked to initial ransoms averaging $925,666, while RansomHub was far more aggressive, imposing ransoms of more than $2.3 million on average.

But while ransoms have shot up, Coalition found that businesses are increasingly refusing to pay. A record 86% of businesses tracked by the insurer chose not to pay out, with the report suggesting this as evidence that more businesses are shoring up their defences with data backups and well‑defined incident‑response plans.

These countermeasures meant that, last year, Coalition saw ransomware claims fall by almost a fifth YoY, to an average loss of $262,000, a considerable fall from close to $500,000 in 2023. 

“The data suggests a turning point in the economics of ransomware: while threat actors escalate their demands to push for higher, seven-figure payouts, cyber insurer support is helping businesses limit losses and is starting to help tip the scales back in favour of defenders,” said Rob Jones, Coalition’s global head of claims.

Recommended reading

• Data Theft Surges to 96% of Ransomware Attacks
• Comment | The History of Ransomware
• Ransomware “Supergroups” Emerge After Record‑Breaking Year of Attacks

Though any decline in ransom payouts is good news, the report cautioned that extortion-based attacks are still a huge threat, with ransomware transitioning into a crisis marked largely by data exfiltration, a more costly threat than traditional encryption alone.

In 2025, dual extortion ransomware, in which threat actors simultaneously encrypt systems and exfiltrate data, was the dominant threat, accounting for 70% of all ransomware claims. According to Coalition, attacks involving data theft are particularly damaging, given that the losses and costs involved are more than double for “straightforward” incidents of encryption.

The study found that incidents of data exfiltration saw firms lose an average of $205,000, compared to $138,000 for encryption-only ransomware.

Coalition said that the higher costs were down to legal, regulatory and reputational impacts, rather than downtime, with incidents of stolen data and potential leaks more likely to require intense forensic investigation and reporting, not to mention carrying a greater threat of lawsuits from clients.