Ransomware Encryption Rate Fell to 50% in 2025 From 70%

Vendor research reports the ransomware encryption rate falling to 50% in 2025, from 70% in 2024.

At 25-1204 this desk filed that manufacturers blocking more ransomware attempts while adversaries shift to data theft are the same finding: better encryption prevention does not reduce attacker revenue, it changes what the attacker sells.

At 25-0713 the same argument was applied to Gulf banking, and at 25-1126c a London borough recorded data copied but not encrypted.

A twenty-point fall in the encryption rate is that argument measured. The corpus should record that it holds, and that the industry measured its progress against the technique it defeated rather than against the outcome.

Encryption is recoverable with backups — Nevada recovered 90% at 25-0921. Publication is not recoverable at all, which the corpus established at 25-0507 where a payment bought a video, and at 25-0815 where a refusal produced 43GB online.

So an organisation that has invested in backups has hardened against the failure mode that is receding and not against the one that is growing.

Payment for a decryption key buys a verifiable deliverable. Payment for suppression buys an unverifiable promise — the position at 25-1231, sharpened by 124 active groups and 73 new entrants at 25-1226.

A shift from encryption to exfiltration is a shift from the transaction that sometimes works to the one this corpus has never seen work. Graded medium: single-vendor telemetry, per 26-0513.