Despite several notices and awareness programs, most organizations are still paying ransom for data decryption post a ransomware attack. Earlier, the FBI warned companies to avoid ransom payments as it encourages others to follow suit. Recently, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) also announced that paying ransom to cybercriminals is illegal. Besides, several industry experts stated that the total cost of recovery from a ransomware attack almost doubles when organizations pay ransom to threat actors.
New research from the Neustar International Security Council (NISC) revealed that over 60% of organizations admitted that they would consider paying ransom in the event of a cyberattack. One in five organizations said they would consider paying 20% or more of their company’s annual revenue.
Key Findings
- Nearly 28% of respondents said they are very confident that all members of their organization know the appropriate measures to take in the event of a ransomware attack, and a similar proportion (26%) lack confidence that this is the case.
- Over 35% perceive guidance from government/official bodies to be insufficient and 26% perceive existing cybersecurity technology to be insufficient.
- Ransomware, DDoS, and targeted hacking were most likely to be perceived as increasing threats to organizations during March-April 2021.
- 56% of enterprises surveyed in May 2021 outsource their DDoS mitigation, in line with the previous reporting period.
- Enterprises were most likely to take between 60 seconds and 5 minutes to initiate DDoS mitigation in May 2021, in line with previous reporting periods.
“Companies must unite in not paying ransoms. Attackers will continue to increase their demands for ever-larger ransom amounts especially if they see that companies are willing to pay. This spiral upwards must be stopped. The better alternative is to invest proactively in mitigation strategies before the attacks, including the use of qualified providers of ‘always-on’ monitoring and filtering of traffic as part of a layered security approach,” said Rodney Joffe, NISC Chairman, SVP, and Fellow at Neustar.
Ransom Paying Trend Continues
Cybersecurity professionals are trying to place more emphasis to prevent the rising ransomware threats. Most organizations are turning to pay the ransom when their current solutions are not sufficient in detecting, mitigating, and preventing cyberthreats.
Recently, multiple popular organizations have paid huge ransoms to recover their data after a ransomware attack. The largest meat-processing giant JBS confirmed that it had paid $11 million to the REvil ransomware gang after attackers compromised its systems. The U.S. Colonial Pipeline reportedly paid $4.4 million ransom after sustaining a sophisticated ransomware attack that caused panic and massive fuel shortages in the country. Also, several industry experts raised concerns over CNA’s failure in detecting the ransomware attack, which led the company to pay a $40 million ransom to recover its systems.
 revealed that 60% of organizations admitted they pay ransom after a attack.){kind=link}