Ransom Ledger

A Fortune 50 firm paidto Dark Angels.

$75 million, Feb 2024. Reported, not confirmed by the victim. Paid in bitcoin in early 2024, per Zscaler ThreatLabz; Chainalysis independently confirmed the figure.

A sourced record of the largest ransom payments, the costliest outages and the groups behind them. Each bar is drawn to scale against the record. See all 7 payments.

What extortion costs,
in six numbers.

75
million dollars, the largest ransom payment on record: to Dark Angels, early 2024.
1.25
billion dollars paid to ransomware gangs in 2023, the record year.
813.55
million dollars paid in 2024, down 35% as more victims refused.
1.5
billion dollars stolen from the Bybit exchange in 2025, which the FBI attributes to North Korea.
1.9
billion pounds, the estimated cost to the UK economy of the attack on Jaguar Land Rover.
2,773
organisations reached by one campaign: Clop’s theft through MOVEit file-transfer servers.

Sources, in order: BleepingComputer; Chainalysis via The Block; BleepingComputer; FBI IC3; Security Affairs; Emsisoft.

The largest ransoms
ever paid

A Fortune 50 firm $75m
CNA Financial $40m
CDK Global $25m
Change Healthcare $22m
Caesars $15m
JBS $11m
Colonial Pipeline $4.4m
Each bar to scale against the $75 million record.

3 of these 7 payments were confirmed by the victim. The rest were traced by journalists or on the blockchain and never denied. Demands were often twice the sum paid.

Payments

  1. Feb 2024A Fortune 50 company to Dark Angels$75 million

    Reported. Paid in bitcoin in early 2024, per Zscaler ThreatLabz; Chainalysis independently confirmed the figure. Unnamed by Zscaler. Bloomberg reported the payer was Cencora; the company has not confirmed it. BleepingComputer, TechTarget

  2. Mar 2021CNA Financial to Phoenix Locker$40 million

    Reported. Paid about two weeks after the attack, against a $60 million opening demand, according to Bloomberg's sources. Demand: $60 million. The Phoenix Locker strain, which researchers tie to Evil Corp. CNA said the group was not sanctioned. Bloomberg, Engadget

  3. Jun 2024CDK Global to BlackSuit$25 million

    Reported. TRM Labs traced about 387 BTC to a BlackSuit wallet on 21 June 2024; sources told CNN that CDK was very likely the payer. CDK has not confirmed it. CyberScoop

  4. Mar 2024Change Healthcare (UnitedHealth Group) to ALPHV$22 million

    Confirmed. UnitedHealth's CEO told the US Senate the decision to pay was his. The operators then kept the affiliate's share and shut down. US Senate Finance Committee, BleepingComputer

  5. Sep 2023Caesars Entertainment to Scattered Spider$15 million

    Reported. Caesars' SEC filing confirmed the theft of its loyalty database and hinted at a payment; Bloomberg and the Wall Street Journal put it at about $15 million. Demand: $30 million. The Register, Infosecurity Magazine

  6. Jun 2021JBS to REvil$11 million

    Confirmed. JBS said it paid to protect its customers and make sure no data was taken. The world's largest meat processor had shut US beef plants. Demand: $22.5 million. CNBC, BleepingComputer

  7. May 2021Colonial Pipeline to DarkSide$4.4 million

    Confirmed. About 75 BTC. The US Justice Department later seized 63.7 BTC of it back, worth about $2.3 million at the time. Dark Reading, CyberScoop

13 groups,
one file each

Who they are, what they have taken, and the news that names them. Each file carries its status as of the latest pinned report.

The costliest outages
and what they stopped

Costs come from the victims’ own filings or from official estimates. Where nobody has put a price on it, the entry gives the damage in the units it was felt: appointments, stores, breweries, days.

  1. Maersk containers stacked under a gantry crane at an APM Terminals yard at night
    Maersk containers at an APM Terminals yard, 2008. APM Terminals is Maersk’s port operator. Photo: William Grimes, public domain.

    Nearly $1 billion

    Jun 2017 NotPetya by Sandworm

    Destructive malware disguised as ransomware spread from a Ukrainian accounting package to Maersk, Merck, FedEx's TNT Express and thousands more. US prosecutors' figure for losses at three US victims alone; Maersk put its own cost near $300 million. US Department of Justice

  2. $2.87 billion

    Feb 2024 Change Healthcare by ALPHV

    Claims processing for much of US healthcare stopped; UnitedHealth advanced more than $6 billion to providers to keep them solvent. UnitedHealth's own estimate of the 2024 cost. GovInfoSecurity

  3. Aerial view of the Jaguar Land Rover Halewood plant beside the Mersey, seen from a plane window
    Jaguar Land Rover’s Halewood plant on Merseyside from the air, 2019. Photo: Richard Hoare, CC BY-SA 2.0.

    £1.9 billion

    Sep 2025 Jaguar Land Rover by Unconfirmed

    Car production stopped on 1 September for about five weeks, reaching more than 5,000 UK businesses. The CMC called it the most damaging cyber event in UK history. Cyber Monitoring Centre estimate of the cost to the UK economy; range £1.6–2.1 billion. Security Affairs

  4. The front of a Marks & Spencer department store with lit shop windows
    A Marks & Spencer store, 2013. Photo: Christopher Hall, CC BY-SA 2.0.

    £300 million

    Apr 2025 Marks & Spencer by Scattered Spider

    Online clothing orders were suspended for 46 days. The chairman told MPs the attackers deployed DragonForce ransomware. M&S's own forecast of the hit to operating profit, before insurance. BleepingComputer, The Register

  5. The MGM Grand hotel towers and lion statue above traffic on the Las Vegas Strip
    MGM Grand on the Las Vegas Strip, 2013. Photo: Tuxyso, CC BY-SA 3.0.

    $100 million

    Sep 2023 MGM Resorts by Scattered Spider

    Reservations, slot machines and room keys failed across Las Vegas. The intruders worked as an ALPHV affiliate. MGM's SEC filing estimate of the hit to third-quarter results. BleepingComputer

  6. The St James’s Healthcare Campus sign in English and Irish in front of a red-brick hospital building
    St James’s Hospital, Dublin, one of the HSE’s hospitals, 2019. Photo: Darren J. Prior, CC BY-SA 4.0.

    About €100 million

    May 2021 Ireland's Health Service by Conti

    More than 80% of the national health system's IT was hit. The HSE refused to pay. The HSE's projected total cost of response and recovery. GovInfoSecurity

  7. A red Deutsche Bahn ticket machine whose screen shows a blue startup screen instead of the ticket menu
    A Deutsche Bahn ticket machine at Munich Hauptbahnhof on 14 May 2017, the weekend WannaCry reached the railway’s systems. Photo: Freddy2001, CC BY-SA 3.0.

    £92 million to the NHS

    May 2017 WannaCry by Lazarus Group

    A self-spreading worm locked computers in some 150 countries in a weekend, including a third of England's hospital trusts. Department of Health and Social Care estimate; 19,000 appointments were cancelled. Infosecurity Magazine

  8. A Coop supermarket with its green sign on a wet autumn day
    A Coop store in Västerhaninge, Sweden, 2022. Photo: AleWi, CC BY-SA 4.0.

    Up to 1,500 businesses

    Jul 2021 Kaseya VSA by REvil

    A poisoned software update spread through IT providers. Sweden's Coop shut about 500 of its 800 supermarkets. Kaseya's count of businesses downstream of fewer than 60 directly compromised customers. BleepingComputer

  9. The brick clock tower of King’s College Hospital against a blue sky
    King’s College Hospital, London, 2015. Synnovis runs pathology for King’s and for Guy’s and St Thomas’. Photo: FormerBBC, CC BY-SA 4.0.

    7,690 postponements

    Jun 2024 Synnovis, London hospitals by Qilin

    The pathology provider for several London hospitals lost its systems; blood transfusions and tests were rationed. Qilin demanded $50 million. NHS England London: 6,199 outpatient appointments and 1,491 elective procedures in the first weeks. BleepingComputer, BankInfoSecurity

  10. Petrol pumps wrapped in yellow caution tape at a Wawa station
    Taped-off pumps at a Wawa in Fairfax County, Virginia, on 15 May 2021, after panic buying emptied the tanks. Photo: Famartin, CC BY-SA 4.0.

    5 days offline

    May 2021 Colonial Pipeline by DarkSide

    The largest fuel pipeline on the US East Coast shut as a precaution, and petrol stations ran dry across the south-east. The pipeline halted on 7 May and restarted on 12 May 2021. Dark Reading

  11. The Asahi Suita brewery: a red-brick hall beside white production buildings and silos
    Asahi’s Suita brewery near Osaka, 2014. Photo: Tokumeigakarinoaoshima, CC0.

    6 breweries stopped

    Sep 2025 Asahi Group by Qilin (claimed)

    Japan's largest brewer stopped shipping; shops and bars ran short of Super Dry. Qilin later claimed the attack. All six of Asahi's Japanese breweries halted production. The Record

  12. National emergency

    Apr 2022 Government of Costa Rica by Conti

    Tax and customs systems went down; Conti demanded $20 million and published most of the 670 GB it stole. Costa Rica declared a state of emergency over the attacks. ManageEngine

Entries
7 payments, 12 outages, 13 groups
Sources
40 reports and filings
Corrections
Open an issue

Ransom Ledger only prints what is on the record: a victim’s own statement or filing, a court document, a government notice, or reporting by a named outlet that traced the money. Every line above links to where it came from, and a payment the victim never admitted is marked reported.

Attribution is the hard part. Groups rebrand, rent their software to affiliates and claim attacks they did not carry out. Where a link between an attack and a group rests on a claim, the entry says so.