United States: $2.1 Billion Paid to Ransomware Gangs Between 2022 and 2024

After peaking in 2023, the amount of ransoms reported to the U.S. Treasury Department declined in 2024.

The Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of the Treasury released a report in early December 2025 detailing the sums paid to ransomware gangs by their victims. The study is based on an analysis of 4,194 payments reported between January 1, 2022, and December 31, 2024, under the Bank Secrecy Act, amounting to a total of $2.1 billion (€1.8 billion).

According to FinCEN, law enforcement operations targeting the ALPHV/BlackCat and LockBit gangs contributed to a significant drop in ransom payments between 2023 and 2024, even though the number of incidents remained relatively stable. Over the period analyzed, the most active ransomware groups were:

ALPHV/BlackCat: $395 million (€339 million) collected across 353 attacks;
LockBit: $252 million (€216 million) across 353 attacks;
BlackBasta: $138 million (€118 million) across 171 attacks;
Akira: $121 million (€104 million) across 376 attacks;
Hive: $96 million (€82 million) across 77 attacks.