The median ransom payment jumped 167% quarter on quarter to $400,000, even as the average fell 45% to $1.03 million, according to Veeam's Q3 2026 ransomware report.
Veeam reads the split as attackers moving up-market: they are setting higher baseline demands for victims with a greater ability to pay, while large businesses are increasingly refusing multi-million-dollar demands. Nearly 80% of data extortion incidents are now resolved without payment, which Veeam takes as a sign that CISOs and legal counsel treat them as governance and reputational issues, and that paying does not guarantee the data is deleted.
Data theft is becoming the main tactic. Exfiltration occurred in 71% of cases, making it the most frequently observed technique, and phishing and social engineering accounted for 29% of initial access.
The report also finds a fragmented threat landscape. The Gentleman and Lone Wolf ransomware types have the highest market share but only 6% of cases each, so Veeam argues that organisations should stop building their strategies around tracking a handful of well-known ransomware brands.
The full report is published on the Veeam blog.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
