FinCEN: Ransomware Payments Surpass $2.1B as 2023 Sets Record High

A new analysis published by the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) reveals that ransomware activity documented in Bank Secrecy Act (BSA) filings has reached unprecedented levels, with total reported payments exceeding $2.1 billion between 2022 and 2024. According to the report, 2023 marked the most damaging year on record, with financial institutions submitting 1,512 ransomware-related reports totaling $1.1 billion in payments—a staggering 77% increase compared to 2022.

While 2024 showed a decline following major law-enforcement disruptions targeting leading ransomware groups, activity remained significantly elevated. FinCEN recorded 1,476 incidents and $734 million in reported payments that year, underscoring the persistent threat landscape. The analysis also highlights several operational insights. TOR-based communication channels were used in 67% of cases where communication methods were disclosed, reflecting attackers’ growing reliance on anonymity networks. Additionally, a small set of ransomware families—including ALPHV/BlackCat, Akira, LockBit, Phobos, and Black Basta—continued to dominate the ecosystem. The top ten variants alone accounted for $1.5 billion in reported payments.

FinCEN stressed the essential role of the financial sector in combating cybercrime. Timely suspicious activity reporting under the BSA enables earlier detection of emerging cyber patterns and supports national security operations. FinCEN Director Andrea Gacki emphasized: “Banks and other financial institutions play a key role in protecting our economy from ransomware and other cyber threats. By quickly reporting suspicious activity under the Bank Secrecy Act, they provide law enforcement with critical information to help detect cybersecurity trends that can damage our economy. This work is vital to safeguarding our nation’s financial sector and strengthening our national security.”

Reference: Finextra