Should You Pay the Ransom in a Ransomware Attack?

Ransomattacks are similar to kidnapping, but instead of a real person being taken hostage, it is your company data. It might be sensitive data such as clients’ credentials. Of course, given the weight those data carries, companies tend to think that it is easier to just give those cybercriminals the money and receive back their data. However, it is not as easy as it seems.

There is abundance of reasons why companies should not pay their attackers. Here are some of the reasons why you should not give way to them.

The Attackers Will Come Back

The ultimate reason to not pay the cybercriminals with what they want is because the attacks will return. With every attack, the amount of money demanded will increase. According to Security Week, around 40% of victims pays the second ransom while a quarter of them paid a third ransom. If there were to get attacked again, only 1% would actually pay.

Your Backups Are Your Real Insurance

If your company is very protective with data, it would mean that the files are stored after they are encrypted hence, you might actually be paying a clown. The hackers might be able to even decrypt your files and is only putting up a show. Bluffing with confidence are what makes the weak look strong. By paying them, you not only will be wasting your money but also degrading you IT technician, programmers and computer engineers who have worked hard to protect sensitive company information and files. 

Paying Does Not Guarantee Your Data Back

Furthermore, paying ransom does not guarantee that your stolen data will be 100% restored. According to Gartner.com, only 65% of data are recovered on average. And even if you received back your data, they might already be corrupted, thus, no longer usable. The money you paid will all go down in vain.

You May Be Funding Crime

Last but not least, paying ransom is the same as funding criminal activities and could lead to civil penalties. The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) imposed civil penalties based on strict liability if any were to engage with a sanctioned individual. Strict liability means that regardless of whether they know the person is blacklisted or not, if they did engage with him, they are held liable.

Prevention Beats Payment

In short, ransomware can be seen as life threatening. It is crucial that companies establish prevention methods in the case that they might get attacked. Still, people love to learn from their mistakes rather than prevent those mistakes. One should take more preventive measure to ensure that no resources are wasted on criminal activities. Paying ransom in a ransomware attack is something no company should do, for you, your clients, your employees and the rest of the public.