Greedy ransomware crews return for seconds after victims cough up first extortion payments

Proofpoint survey data shows a high prevalence of ransomware extortion: many organizations pay ransoms (58% UK, 54% global), 22% of payers face repeat extortion, and a small percentage never recover files; law enforcement takedowns (e.g., Operation Cronos/LockBit) and incidents like Nitrogen illustrate attackers retaining data or decryptor failures, while AI is making pre-ransomware phishing and reconnaissance more effective—underscoring that paying ransoms is unreliable and organizations should build cyber-resilience.