According to Gartner, “The percentage of nation-states passing legislation to regulate ransomware payments, fines, and negotiations will rise to 30 percent by the end of 2025, compared to less than one percent in 2021.” In the U.S., government organizations such as the FBI and  the Cybersecurity and Infrastructure Security Agency (CISA) advise victims to report the incidents to law enforcement and not pay ransoms. Still, there were large payouts in 2021. For example:
Insurer CNA Financial paid a $40 million ransom.
Meat supplier JBS paid an $11 million ransom.
High-profile cases make the headlines, but cyberattacks on small businesses account for about 75% of all ransomware incidents, according to the U.S. Department of Justice (DOJ).