On December 4, 2025, FinCEN issued a Financial Trend Analysis of ransomware incidents in BSA data from 2022 to 2024, totaling more than $2.1 billion in ransom payments. The report shifts the focus to the incident dates of each ransomware attack and provides greater visibility into the activities of ransomware actors.

Key highlights of the FTA include:

Reported ransomware incidents and payments reach an all-time high in 2023. In 2023, ransomware incidents surged to a record 1,512 cases with $1.1 billion in payments, but decreased to 1,476 incidents and $734 million in payments in 2024, while the median transaction amounts varied from $124,097 in 2022 to $175,000 in 2023 and $155,257 in 2024.
FinCEN data shows ransomware payments top $2.1B in just three years. During the three-year review period from January 2022 to December 2024, FinCEN received 7,395 BSA reports on ransomware incidents totaling over $2.1 billion in payments, compared to 3,075 reports and approximately $2.4 billion in payments during the previous nine years (2013-2021).
Financial services, manufacturing, and healthcare were the most impacted industries.The manufacturing industry reported 456 incidents with payments totaling about $284.6 million, the financial services industry had 432 incidents totaling around $365.6 million, and the healthcare industry recorded 389 incidents with approximately $305.4 million in payments.
The Onion Router (TOR) was the most common communication method reported. The majority of ransomware threat actors communicated with targets through The Onion Router protocol, making up 67% of reports, while others used email or private encrypted messaging systems.
ALPHV/BlackCat was the most prevalent ransomware variant between 2022 and 2024. FinCEN reported over 200 ransomware variants in BSA data, with the most prevalent being Akira, ALPHV/BlackCat, LockBit, Phobos, and Black Basta, collectively accounting for around $1.5 billion in payments from the top 10 variants.

Read FinCEN’s press release here.

The full Financial Trend Analysis can be found here.

Adam Witmer

Adam Witmer is a speaker, author, and founder of the Compliance Cohort. Adam has taught hundreds of seminars and training sessions to thousands of bankers throughout the United States and teaches on all areas of regulatory compliance. Adam has written five e-books that he never published, hit a grizzly bear while driving in a National Park, and is an award winning photographer and musician (though he no longer takes photos nor plays any instruments). In his spare time, Adam can be found kayaking on the lake, doing taekwondo with his kids, working on his (project) house, or spending time with his family.

Website

Become a Free Member