Median Ransomware Demands Grow to $600K a Pop

Arctic Wolf's data shows 2023 median initial ransom demands rose 20% to $600,000, with some sectors (legal, government, retail, energy) frequently facing median demands of $1M or more. Manufacturing was the most represented industry on ransomware leak sites, followed by business services, education/nonprofit, and retail/wholesale. The ransomware landscape is dominated by a few operators—LockBit (926 attacks in Arctic Wolf telemetry), BlackCat/ALPHV, and Cl0p—though law enforcement actions have recently disrupted some of these groups.