You’ve Been Breached by Ransomware—Should You Make the Payment?

Today, ransomware is an increasingly common threat to businesses across industries. Cybercriminals target organizations with the intention of locking them out of their systems or data, demanding a ransom in exchange for restoring access. When faced with a ransomware attack, many organizations find themselves struggling to decide whether to engage with the attackers or find an alternative means of addressing the situation. While there is no one-size-fits-all answer, understanding the pros and cons of making the ransom payment can help your organization better prepare for this high-stakes scenario.

To pay or not to pay

When your company’s critical systems or data are held hostage by cybercriminals, the pressure to resolve the situation quickly can be overwhelming. Paying the ransom may seem like the fastest route to minimizing downtime, especially for businesses that rely heavily on their data or have limited backup systems in place. Take for example the ransomware attack on MGM Grand, which ended up costing the company over $100 million in business disruptions. Seeing scenarios like this can be scary, but before engaging with attackers, it’s important to carefully consider your options.

Paying can be risky

Paying the ransom may seem like the easiest solution, but it comes with a few caveats. First and foremost, even if you pay and your data is restored, the attackers may leave behind malware or backdoors, which could lead to future compromises (it may also encourage cybercriminals to target your organization again, as it signals a willingness to pay). On the other hand, there’s no guarantee that the attackers will provide a working decryption key in the first place. This is not always the case and largely depends on the individual or organization you’re dealing with, but it’s still an important consideration when weighing your options.

When it might make sense to pay

In some cases, paying the ransom might be the best solution, such as if the attack is targeting irreplaceable or sensitive customer data. Data leaks can wreak havoc on your brand’s reputation, and if the data being held hostage falls under the purview of certain laws like GDPR or HIPPA, it’s important to factor that into the equation as well. Furthermore, if the cost of prolonged downtime or loss of access to critical systems outweighs the ransom demand, it could make sense to pay in order to minimize losses and restore business operations as quickly as possible.

Don’t make the decision alone

If your organization ever falls victim to ransomware, it’s important to engage legal counsel and qualified ransom negotiators to determine the best path forward. In the meantime, investing in preventative measures like strong backup systems, robust security protocols, and a clear incident response plan is an effective way to proactively protect your organization.