Ransomware attacks declined 18% in Q1 2026 compared to Q1 2025, according to data from Chainalysis and multiple cybersecurity firms. It's the first significant quarterly decline since 2020.
Security experts attribute the decline primarily to AI-powered defensive tools that can detect and block ransomware in its early stages, before encryption begins. These tools analyse file system behaviour patterns to identify ransomware activity.
Cryptocurrency tracing has also improved. Law enforcement agencies, using AI-powered blockchain analysis, recovered $4.1 billion in ransomware payments in 2025 — making the crime less profitable.
However, experts warn against complacency. While volume is down, the average ransom demand has increased 34% to $2.8 million, as attackers focus on larger, more lucrative targets.