Security News > 2024 > January > What makes ransomware victims less likely to pay up?

There's a good reason why ransomware gangs started exfiltrating victims' data instead of just encrypting it: those organizations pay more.

University of Twente researcher Tom Meurs and his colleagues wanted to know which factors influence victims to pay the ransom or not, and which factors have an effect on the ransom amount organizations end up paying.

Based on the data provided by the Dutch National Police and a Dutch incident response organisation on 481 ransomware attacks between January 2019 and January 2023, they discovered that "Cases involving exfiltration of data result in a higher probability of payment, as observed in 40% of such incidents, compared to 25% when no data exfiltration occurs."

The researcher found that the decision to pay depends on whether the victim organization has backups and whether they have hired an incident response company to deal with the attack.

Victim organizations that have recoverable backups were 27.4 times less likely to pay off ransomware attackers than those without recoverable backups.

Data exfiltration, insurance coverage and the yearly revenue of the victim, on the other hand, are factors that affect the ransom amount a victim will pay.

News URL

https://www.helpnetsecurity.com/2024/01/26/what-makes-ransomware-victims-less-likely-to-pay-up/