More Companies Paying Ransoms After Cyberattacks

The number of companies paying ransoms to cybercriminals has seen a significant increase over the past year, driven largely by the advancement of artificial intelligence in facilitating more sophisticated attacks. A study conducted by S-RM, a cybersecurity firm, alongside FGS Global, an advisory group, revealed that the proportion of businesses acquiescing to ransom demands rose to 24.3 per cent in 2025. This figure starkly contrasts with the 14.4 per cent recorded in 2024 and the 16.4 per cent in 2023, although it remains below the 27.6 per cent noted in 2022.

The study indicates that businesses in the industrial and manufacturing sectors experienced a notable escalation in ransom payments. This uptick is attributed to the operational disruptions caused by ransomware incidents which paralysed key infrastructures. Among the most publicly discussed victims was Jaguar Land Rover, whose factories worldwide halted production for an entire month due to an attack on its IT systems. Other notable targets in 2025 included Marks & Spencer and Co-op, both of which have not confirmed whether they paid any ransoms.

The report does not disclose specific companies that paid ransoms, a detail many organisations are reluctant to share. The prevailing concern is that revealing any ransom payment may lead to heightened risk of future attacks.

Ransom payments last year varied widely, ranging from as low as £10,000 to figures exceeding £1 million, with the average payment standing at £296,000. Jamie Smith, head of cybersecurity at S-RM, noted that attackers increasingly utilise AI tools to identify sensitive information that could inflict maximum damage. This growing trend has culminated in threats that are both more targeted and personalised, designed to heighten the victim’s fear and willingness to comply with demands.

Jenny Davey, co-head of crisis management at FGS, remarked on the duality of AI’s role. While it can enhance operational efficiency and performance, it concurrently creates new vulnerabilities for businesses, providing cybercriminals with fresh avenues for exploitation.