How to Navigate Ransomware Demands & Negotiations
One of the greatest threats facing businesses today is the risk of a ransomware attack. By encrypting data, hackers effectively lock companies out of their computer systems, bringing operations to a halt and in some cases forcing businesses to shutter their doors permanently.
Given these high stakes, it’s no surprise that many businesses are forced to consider giving hackers what they want: a ransom payment to decrypt the data. But should they?
In most cases, the answer is no.
Businesses should avoidpaying the ransomunless they have no other viable options for survival. In this post, we explore the reasons why.
Should You Pay Ransom to Hackers?
No. You should not pay a ransom to hackers except as a last resort to avoid a catastrophic disruption to your operations.
When dealing with ransomware or any other cyberattack, it’s never a good idea to give in to hackers’ demands. For one thing, the FBI advises companiesnot to pay the ransom. Ransomware attacks are a serious crime, and the act of paying the bad actors only supports their criminal activity (and the industry that fuels it). We’ll have more to say on that below, but the point here is that law enforcement agencies are very clear that businesses shouldnotpay.
What the FBI Says About Paying the Ransom
In its Ransomware Prevention guide, the FBI warns, “The United States Government (USG) does not encourage paying a ransom to criminal actors” and doing so comes with “serious risks.” Among other things, the FBI writes, “Paying the ransom doesn’t guarantee an organization will get their data back. We have seen cases where organizations never got the decryption key after having paid the ransom.” That’s just money down the drain that most companies will never recover (along with their data if they don’t have backups).
Let’s explore this point a bit further, along with other key reasons why the FBI and cybersecurity experts warn against paying the ransom.
Reason #1: There’s No Guarantee You’ll Get the Data Back
We can’t stress this enough: paying the ransom is a gamble, not a guarantee. Hackers are under no obligation to do anything when you pay the ransom. And since payments are made anonymously via cryptocurrency transactions, they can easily just take your money and run.
For businesses, this only adds insult to injury. The hackers clearly win, and the business suffers the embarrassment of having paid up and received nothing in return.
No industry is immune to these risks. All organizations face the threat of ransomware, including healthcare, manufacturing, construction, retail, real estate, hospitality, education and financial institutions. All of them face the same risk of tossing their money down the drain when they pay the ransom.
Case in point: They paid up, and hackers took off.
A staggering 92% of companies that pay the ransom do not getallof their data back, even with a decryption key, according to research by Sophos Cybersecurity. That’s what happened to an undisclosed company in 2021 after beinghit by ransomware. A ransomware group known as BlackMatter used a phishing email to deceive a single employee at the company and then fully infiltrated the company’s systems, installing hacking tools across the network. In addition to locking up the company’s sensitive data, attackers threatened to release it publicly if the company didn’t pay up. The company gave in to the demands and paid the ransom – but it didn’t matter. Attackers leaked the data anyway, and the company was forced to restore some of its data from backups.
Reason #2: When You Pay the Ransom, It Only Encourages the Criminals to Launch More Attacks
When you pay a hacker a ransom during a ransomware attack, it just funds their operations and encourages them to continue their criminal actions and behaviors on other companies. You are basically just funding cyber terrorism when you give in to their demands.
Hacking groups can take that money to develop even more advanced methods of using malware to infiltrate vulnerable businesses of all sizes. So by paying the ransom, you only make ransomware worse.
On the flipside, the more obstacles that hackers face in their criminal activities, the chances of them being able to continue to hurt other companies goes down.
Case in point: ransomware is big business.
For sophisticated attackers, ransomware is a reliable way to (illicitly) generate revenue and avoid detection – precisely because so many companies pay the ransom, typically via untraceable crypto payments. Prior to 2020, there were 4 major ransomware groups that were responsible for the majority of attacks around the world. This number ballooned to more than 20 groups within the last 3 years. As of 2023, LockBit was the biggest ransomware group, responsible for an estimated 40% of all attacks. The group rakes in an estimated $91 million in ransom payouts a year from U.S. victims alone, according to figures from Bitdefender.
Reason #3: Your Company Might Be Sanctioned When They Pay the Ransom
As cyberattacks ramped up during the COVID-19 pandemic, the U.S. Treasury issued a statement that warned of the risk of sanctions for paying out ransoms to hackers. In essence, the new guidance made the act of paying the ransom illegal, in theory.
Keep in mind that the people behind ransomware aren’t just individual hackers launching attacks from their basem*nts. In many cases, they’re foreign nation-states, terrorist groups or other adversaries of the United States. So by paying their ransom demands, you are effectively supporting those adversaries.
The legality of the whole situation is still a bit unclear at the moment, but the last thing you want is a federal sanction against your organization, on top of already paying out a big ransom to the cybercriminals.
Case in point: Feds are going after ransom facilitators, for now
According to some estimates, as much as 15% of ransomware payments involve a U.S.-sanctioned entity. However, the government doesn’t seem to be going after thevictimswho are forced pay these ransoms – at least not yet. Since the U.S. Treasury announced its threat of sanctions in 2020, we have not heard of any companies being slapped on the wrist for negotiating with their attackers, regardless of whether those attackers are connected with sanctioned groups. But the Fedsaregoing after some facilitators of these payments. In 2021, the Office of Foreign Assets Control(OFAC) sanctioned Chatex, a Russian-operated virtual currency exchange, and a connected entity, Suex, for facilitating payments to ransomware groups. As part of this announcement, the government emphasized that all “companies are encouraged to report all ransomware incidents to law enforcement, as well as any payments with a potential sanctions nexus to OFAC.”
Reason #4: You’ll Be Targeted Again
When you pay the ransom, this puts another target on your back. By paying, you’re telling the hackers. “You win. Your attack worked. We’re willing to pay.” Naturally, this makes your business more likely to be the victim of a second attack.
Plus, if a second attack does occur, the odds are that the hackers will ask for a higher sum of money the next time. Look at it this way, if you feed birds at the beach, they are going to expect food and keep coming back to bother you again and again. You’ll never eat in peace at the beach because the birds expect people to feed them food. It’s a similar thing with hackers. If they know a company is going to pay up, they will continue to launch their attacks against them for the reward of additional ransom payments.
Finally, keep in mind it may not even be the same group to attack the company more than once. Hackers may sell information about the company to other groups. Or, the mere publicity of a successful attack can make the business a target with other hackers.
Case in point: 80% of companies are attacked a 2nd time
A 2022 study by Cybereason found that 80% of companies that paid a ransom were hit again at a later time. Among those, 40% paid up a second time, with 70% of those companies paying a higher amount than in the first attack. The UK’s National Cyber Security Centre recently alluded to one unnamed company thatsuffered such a repeat attack. The company paid their attackers nearly £6.5million (more than $8 million USD) and successfully received the decryption keys to restore their data. But oddly, they never filled the security gaps that led to the attack. Two weeks later, they were attacked again – by the same attacker – and were forced to pay up a second time.
Reason #5: The Hacker May Simply Increase the Demand
In astatementabout previous attacks and the risks of paying the ransom, the FBI writes, “After paying the originally demanded ransom, some victims were asked to pay more to get the promised decryption key.”
When the hacker states the ransom payment they want, and you immediately pay it, what’s to stop them from simply upping the demand after that initial demand is met? There isn’t any guarantee that they will just want one simple payment.
It’s worth reiterating that you should not expect shady cybercriminals who disrupt your business to have any kind of moral compass. When you pay them, you are just falling into the hole of sending them more and more money, without getting your data back in return. The less you give in to them, the better.
Case in point: 1 in 3 victims are asked to pay more
Researchers at Proofpoint found that a third of ransomware victims that paid a ransom were forced to pay an additional ransom payment before receiving their decryption key. When Kansas Heart Hospital was infected with ransomware, disabling some of its most critical systems, administrators decided that the fastest way to recover was to pay the attackers. So they paid up. But the attackers did not release their data. Instead, they asked for more money. While ransomware hackers are sometimes willing to negotiate a lower payment with their victims, other attackers use the initial payment as bait. When companies pay up, it’s a sign that they have no other options, so the attackers ask for more before handing over the decryption key.
Reason #6: Your Cyber Insurance Rates Could Go Up
With the rise of ransomware over the past few years, businesses have begun seeking insurance policies that help to cover the costs of an attack, including ransom payments made to attackers. But once again, paying that ransom, even if it’s via an insurance company, can have consequences.
In addition to the risks outlined above, if you have cyber insurance that is used to pay the ransom demand for you, it’s likely that your insurance rates will go up. The insurance company is covering your business for what they call “cyber extortion” under the umbrella of a cyber liability policy. While it’s a smart move to have this type of insurance “just in case,” you should still think twice before you negotiate with your attackers at all.
Case in point: Premiums up by 50% in one year
For auto insurance, it’s well known that premiums can increase significantly after you have a car accident. The same is true for cyber insurance. One analysis found that 74% of victims that paid a ransom saw a rise in their premiums. But also, premiums can skyrocket even if you haven’t experienced an attack at all. Industry-wide, the costs of cyber insurance have been increasing by as much as 50% per year, due to rising ransomware demands across the globe. Additionally, keep in mind that ransom payments account for as little as 15% of the overall cost of a ransomware attack, according to some estimates. Operational disruptions and prolonged recoveries can be staggeringly expensive. As ransomware continues to wreak havoc on businesses, the costs to insure against these attacks will only continue to increase.
When You Have No Choice But to Pay
We understand that there are some cases where a company feels it has no other option but to go ahead and pay the ransom to the attacker. And the FBI also delicately acknowledges this in its guidance, stating: “Whether to pay a ransom is a serious decision, requiring the evaluation of all options to protect shareholders, employees, and customers.”
If, for example, a company has no other way to operate with time-sensitive business functioning, it might be in its best interest to take the gamble of paying the ransom. This is especially true for healthcare organizations, whose operations can literally mean the difference between life and death. Such organizations need their data back to function correctly or they run the risk of shutting down permanently.
In these circ*mstances, you can understand why companies may be willing to pay the ransom, even if there’s no guarantee.
But still, this is typically an absolute last resort. And with the right data backup systems in place, businesses may never have to face that decision in the first place.
What Happens if You Don’t Pay Ransomware Attackers?
Typically, nothing else will happen if you don’t pay ransomware attackers, but your data will still be encrypted. You will need to restore your files from a backup, or determine if a decryption tool can be used. That is the recommended response: restore your data internally, so you don’t have to pay the ransom.
Attackers may threaten to release your data publicly if you do not pay, but this is often a bluff. Not all ransomware attacks include data exfiltration in addition to encryption, but attackers will threaten double-extortion in an attempt to scare their victims into paying. Analyze your systems to determine if any data may have been leaked. If the threat was included in the same generic message that alerted you to the ransomware, without any detail or context, then it was likely a scare tactic.
However, whether you pay ransomware attackers or not, you must identify the security gaps that allowed the attack to happen. Otherwise, you may be hit again in the future.
Make Sure Your Company has a Comprehensive Data Backup Plan
One of the reasons most companies pay the ransom is that they don’t have reliable data backups that can be restored fast enough (if they have any backups at all).
Data backups can be used to restore encrypted files back to a clean slate after a malicious attack. By rolling back to a recovery point from before the infection occurred, you can restore your data back to normal and also remove the infection itself. This also eliminates the question of having to pay the ransom.
The type of data backup system you deploy is important. TheDatto SIRISis an all-in-one business continuity and disaster solution that provides dependable protection against ransomware and other data-loss events. In addition to providing fast backups and numerous restore methods, accessible both locally and in the cloud, the Datto SIRIS has built-in ransomware protection to detect early signs of an infection.
By being able to rapidly restore data from backups, you effectively stop an attack in its tracks and never have to face the difficult decision of paying your attackers.
Ransomware Negotiation Tips
If you’ve exhausted all other viable options for recovering business-critical data, negotiating with ransomware attackers may be the only remaining option. However, this is a complex situation with no guarantee for success, so it must be approached very carefully. Here are some general tips if you are considering ransomware negotiation:
- Involve law enforcement. Report the incident to a law enforcement agency, such as a local FBI field office. These agencies have dedicated cyber divisions that can assist you with the response and negotiation procedures.
- Use an experienced negotiator. Leverage the expertise of a third-party cybersecurity firm that specializes in ransomware negotiation. These experts will negotiate on your behalf using tactics that ensure the best possible outcome.
- Consult with your cybersecurity insurance provider. If your company has cyber insurance, your insurer may have their own ransomware negotiators or a recommended provider. In communication with attackers, be sure not to reveal whether or not your company has cyber insurance.
- Establish secure lines of communication lines. Cybersecurity experts at AT&T recommend negotiating additional communication channels that involve mutual trust, beyond the initial channel provided by the attacker.
- Don’t pay the ransom up front. Negotiate an upfront deposit with the remainder to be paid after a working decryption key has been provided.
- Ask attackers to demonstrate that the key works. Before any payment is made, ask the attackers to decrypt some random files to demonstrate that the decryption key actually works.
- Continue negotiation talks. Even if the attackers have agreed to a lower ransom, cybersecurity negotiators recommend pushing for further reductions. Remember that the attackers’ core goal is getting paid, and if they sense their victim is willing to walk away from the negotiation, they may be willing to lower their price.
Frequently Asked Questions (FAQ)
1. Does paying the ransom for ransomware work?
In a ransomware attack, paying the ransom does not guarantee that attackers will provide the decryption key. Even with the key, most organizations are unable to recover all their data with decryption alone. In one study, as much as 92% of companies failed to restore all their data even after paying the ransom.
2. What is the current average ransomware payout?
As of 2023, the average ransomware payout exceeded $1.5 million, according to a survey of 3,000 senior IT and cybersecurity professionals. More than 25% of the companies that paid a ransom were forced to pay between $1 million to $5 million.
3. How many ransomware victims pay the ransom?
About 41% of ransomware victims decide to pay the ransom, according to data from Coveware. This figure dropped from 50% the year prior, signifying that more businesses are implementing stronger disaster recovery solutions that remove the risk of paying the ransom.
Conclusion
Deciding whether to pay the ransom in a ransomware attack can be difficult for a business, especially when there are few other viable options. As a rule of thumb, companies shouldnotpay the ransom unless they have exhausted all other options. Instead, businesses are encouraged to implement aggressive preventative measures, as well as robust data backup systems that can rapidly restore systems and eliminate the need to negotiate with attackers at all.
Implement a Stronger Backup Solution for Ransomware – So You Never Have to Pay the Ransom
Learn more about protecting your organization from a ransomware attack with BC/DR solutions from Datto.Request a free demoor speak to our business continuity experts at Invenio IT today. Call (646) 395-1170 or emailsuccess@invenioIT.com.
