Should Companies Pay to Settle Ransomware Attacks

iQuanti: Ransomware attacks that are notoriously difficult to stop increased in the last few years. Victims include companies of all sizes and industries, but some of the largest or most damaging have impacted gas pipelines, banks, and hospitals. Their invisible paper trail and growing frequency even worry seasoned cybersecurity experts. Consequently, the threat of a ransomware attack is a serious concern for many enterprises. But is the best way to handle a ransomware attack to simply pay up, or not? Here are the pros and cons. Paying Off a Ransomware Attack Benefits

The fastest way to solve a ransomware attack is to pay the ransom. Most ransomware criminals are only interested in an opportunity to make money quickly, so if you pay the ransom, there is a good chance you receive your files back without any extra trouble. You avoid the cost of rebuilding your cybersecurity infrastructure. While you should still dedicate resources backing up and prepping your IT network so that an attack doesn’t happen again, paying the ransom may costs you much less than rebuilding your entire IT infrastructure. You can work with a negotiation or incident response team to lower the cost. If the attackers demand an amount your company cannot pay, you can call in a negotiation firm to try and lower the ransom amount. Of course, these firms cost money themselves and cannot guarantee success, so proceed at your own risk.

Risks

There is no guarantee you will get your files back. Even if you pay the ransom, attackers can still withhold your data or try to extort you a second time, an experience known as double extortion. Even if you do get your files back, hackers could potentially sell your data to a third party. Once a ransomware attacker has stolen your information, nothing stops them from selling your data to other organizations.

The same group can attempt another attack. Resolving one attack with a group of cyberattackers is no guarantee that they won’t attempt the same threat again, often successfully. Paying can be an impermanent solution when the root issues aren’t addressed.

Refusing to Negotiate Benefits

You may be able to keep or maintain trust in your organization or brand. Public organizations      such as city halls and hospitals cannot be viewed as negotiating with criminals, so it may be in their interest to halt negotiations. If your company is properly backed up and prepared for a ransomware attack, you incur a significantly lower cost, even if it takes a little more time to recover your data. Hackers have no leverage if your information is safely stored and encrypted in another location. However, you must also be certain that the attackers couldn’t compromise confidential information.

Risks

Your IT network could be offline for a longer time. Negotiation can take much longer than settlement, so      be prepared to halt business for a temporary period. If your company is not prepared, the costs of recovery may be much higher than paying the ransom itself. A ransomware attacker with access to your entire IT network can wreak havoc and often cause irreparable damage. This chaos can cost your company significantly more than simply paying off the ransom if your company hasn’t set up adequate preventative measures.

Source: iQuanti, Inc.