Zscaler's new ransomware report puts hard numbers behind something a lot of security teams have been feeling all year. Ransomware attacks are up 275% year over year, increasingly assisted by AI, and victims paid $328 million in extortion. The average ransom payment now sits at $431,995, according to the report as published through GlobeNewswire.

Those figures are worth reading slowly, because they point in a direction that is easy to miss. Ransomware is not fading into the background as a problem we have mostly figured out. It is evolving, and in several ways it is getting harder to see and more expensive to deal with.

What the Numbers Are Telling Us

Start with the headline figure. A 275% year over year increase means attacks are not creeping up, they are multiplying. The $328 million in extortion payments gives that growth a price tag, and an average payment of $431,995 puts the stakes in terms any business owner can picture. This is no longer a nuisance cost that gets absorbed quietly. It is a line item that can change the trajectory of a company.

It is also worth saying that these are reported payments. The real cost of an incident is larger, because it includes downtime, legal fees, notification costs, and lost trust, none of which show up in an extortion figure. The numbers in this report are best read as the floor, not the ceiling.

The Shift From Loud to Quiet

The part of this report that deserves the most attention is the change in how attackers operate. They are moving away from disruptive file encryption, the kind where screens lock and everyone knows immediately that something is wrong, toward quieter, harder to detect data theft.

That matters for a practical reason. A lot of ransomware preparation has been built around one scenario: your files get locked, and your job is to restore them. Good backups are the answer to that scenario, and they remain essential. But backups do nothing for a theft. If an attacker quietly copies your customer records, contracts, or financial data and then demands payment to keep it private, restoring your systems from backup does not un-leak anything. The conversation shifts from "how fast can we recover" to "what do we owe, who do we have to notify, and what happens when this becomes public."

Quiet theft is also harder to notice. An encryption attack announces itself. Data leaving your network over days or weeks, in volumes that look roughly like normal activity, may not announce itself at all. The first sign is often a message from the attacker.

AI Is Part of the Acceleration

The report describes these attacks as increasingly AI-assisted, and that fits a broader pattern. AI tools help attackers research targets faster, write more convincing messages, and scale their efforts without adding people. None of that requires a sophisticated operation. It lowers the effort needed to run a campaign, which helps explain how attack volume can climb as sharply as it has.

The encouraging side is that the same tools are available to defenders, for spotting unusual activity and prioritizing what needs attention first. The gap is not about who has access to AI. It is about who is putting it to work, and how quickly.

What This Means for Your Business

Plan for theft, not just encryption. Review your ransomware plan and ask a plain question: if someone copied our data without locking anything, would we know, and what would we do? Many plans only answer the encryption scenario.

Keep your backups, and stop treating them as the whole answer. Isolated, tested backups are still essential. They solve availability. They do not solve exposure.

Know where your most sensitive data lives. You cannot protect or monitor what you have not mapped. Customer records, financial data, and contracts deserve the closest watch.

Ask how unusual data movement would be detected. The question to put to your IT provider is simple: if a large amount of data left our network unexpectedly, how would we find out, and how quickly?

Talk to your insurer about extortion and data theft specifically. Many people assume coverage is the same for both. It is worth confirming what your policy actually covers before you need it.

The Bigger Picture

The most useful way to read this report is as evidence that ransomware is a moving target. The attacks are more frequent, more expensive, and more likely to involve stealing data quietly than locking it loudly. Businesses that adapt are not the ones reinventing their entire security approach, they are the ones updating their assumptions, and making sure their plan covers what attackers are actually doing now.

Stay inside the line.