To Pay or Not to Pay? That Is the Ransomware Question

Whether tis nobler to hand over millions in bitcoin to a hacker or to keep those digital wallets sealed tight is up to the individual business.

One’s first instinct might be to pay, pay, pay. Data is locked up tight, and sensitive client, customer and employee information is on the line … not to mention business reputability and operations. But paying a hacker outright might not be the best first step.

“Most hackers are financially motivated and are aiming to disrupt their victims’ operations to extort money from them. Frequently they are also threatening to expose sensitive data. Now, if you’re a business or an educational or healthcare entity, you want to avoid all of those, and therein lies the appeal [to pay right away],” said Bala Larson, head of client experience, cyber risks, Beazley.

Ransomware payments can be costly. IBM reported the average cost of a data breach increased by 2.6% from 2021 to 2022 — which, in dollars, went from $4.24 million to $4.35 million. (And the year’s not over yet.)

Such a price tag can come with innumerable financial backlash, especially if a ransom is paid outright by the organization. So, before a company decides to hand over the cash, they should be asking themselves: To pay or not to pay?

So … I Shouldn’t Pay Right Away?

Paying ransom should be looked at and assessed just like any other business decision — albeit on a truncated timeline. While in the moment it might feel almost impossible to do anything but give in to the hacker’s every demand, it’s important to breathe, take stock and turn to the experts.

“The decision to pay or not to pay should never be a unilateral one,” said John Farley, managing director, cyber liability practice, Gallagher. “It’s got to involve key stakeholders around the table. It’s going to cut across a wide variety of departments in any organization. So, you’re going to involve the legal department. You’re going to involve operations. You’re going to involve finance. You’re going to involve communications. Each and every one of those stakeholders will be impacted when you make this decision.”

It’s also imperative these individuals within each department understand their role in the ransom response. Before an attack, organizations will want to create and implement an effective incident response plan, or IR plan.

The IR plan’s purpose is to have pertinent information on what to do, who to call, which team member is responsible for what, as well as have insight on data types the company stores and how it’s being stored. This plan should outline what the organization wants to do as a response to a data breach, including the process to follow when it comes to making ransom payments.

But this IR plan must be effective, meaning it needs to be tested before an event.

“We always suggest that organizations have a robust incident response plan, but one that has also been tested. It’s nice to have one, but it needs to be tested and it needs to be tested on a very regular basis to ensure that it works in practice,” Larson said.

Having this plan in their back pocket, company stakeholders will have a guide on what to do with a ransom — and be advised on when to pay it.

Know What’s at Stake

Hackers’ tactics change just as quick as technology grows, and data encryption has become the key means of disrupting operations. Extortion and double extortion are hacker favorites.

“Double extortion is when a threat actor exfiltrates, or takes a copy, of a victim’s data before encrypting it. Then they are demanding a ransom both for the key to decrypt that data and also a promise that they will delete that data,” Larson explained.

“The issue, of course, is that victims don’t know whether or not that data has already made its way into the dark web or been accessed by other unauthorized individuals, and other bad actors not associated with this one may choose to leverage that.”

The semi-good news is that hackers typically keep to their word once they receive payment.

“If they didn’t, their business model would fail. Nobody would pay if for the majority of times they didn’t live up to that end of the bargain,” said Farley. But, he added, payment doesn’t mean that the issue is fully resolved.

“You may have a legal obligation to notify affected individuals whose sensitive data may have been exfiltrated … you may have a duty to notify people, and that notification often comes with reputational and financial harm.

“There are strong opinions in society as to whether or not we should be paying hackers at all,” Farley continued. “And if you decide to pay, there may be some reputational harm associated with that. Conversely, if you don’t, pay and let’s say you are a hospital or an operator of critical infrastructure, there can be repercussions for society as a whole because you didn’t pay.”

Reputational risk from the decision to pay (or not to pay) a ransom can have lasting consequences. One PwC study found 87% of consumers are willing to walk away and take their business elsewhere if, or when, a data breach occurs.

This added layer can complicate things, making it imperative for businesses to partner with experts who understand the repercussions of making a ransom payment.

Let’s Talk About It

A good way to start building a cyber response team filled with cyber experts is by finding a good hacker negotiator.

“A savvy ransomware negotiator will not only bring the amount of the ransom down but will also be able to draw information that’s going to be vital in helping them make that determination of whether or not they want to pay or when they want to pay. Crucially, negotiating with threat actors also allows victim organizations the time to investigate the root cause of the attack, contain that and begin recovering from backups,” said Larson.

On average, hackers will negotiate down a ransom by 70%, according to data compiled by Arete, which means that negotiation is a vital step in the payment process.

With the help of a ransomware negotiator, Farley and the team at Gallagher did an analysis of negotiation: “We’ve done an analysis of different variants of ransomware,” Farley explained, “and what it meant when a hacker went in and negotiated in terms of bottom line payments. We concluded a reduction of nearly one million dollars every time the Conti variant of ransomware was negotiated.”

That, he said, could mean huge savings to the organization’s bottom line.

In the Gallagher research, the negotiator had a very clear and detailed understanding of the Conti variant of ransomware. The negotiator also knew whether or not the Conti hackers would be willing to negotiate based on past negotiations. All this is to say, equipping an organization with a skilled negotiator who understands how hackers react is paramount.

Negotiators have the skills to review demands in conjunction with the extent of the breach. They will know what an appropriate response is to a high-cost demand and can help companies avoid lowballing the hacker with a counter offer. Additionally, trained negotiators can get the organization in touch with cryptocurrency reserves — something not every business has on hand.

“When you’re engaging the negotiator, they’re going to have access to cryptocurrency,” Farley said. “That’s a really good thing, because many organizations don’t have access to a large amount of cryptocurrency.”

Looping in cyber insurance experts at this stage in the payment decision should also be a top priority outlined in the IR plan. That is because the insurance experts such as digital forensics and ransomware negotiators “may know of flaws in, for example, the attackers’ encryption that could lead to a positive outcome and they may not even have to make a payment,” said Larson.

When Payment Isn’t an Option

A good cyber team can also prevent a business from making illegal payments.

While the decision to make a payment has its own set of risk and reward, sometimes, when the attack is coming from specific terrorist organizations, U.S. law prohibits businesses from making payments. An expert cyber team should be able to suss out who is behind the keyboard strokes before payment is made illegally.

“There are federal laws that basically say, in certain circumstances, you cannot pay certain hackers. OFAC, the Office of Foreign Assets Control, dictates that you cannot pay certain groups or individuals, such as certain terrorists, for example,” said Farley.

“If you do, you have now violated federal law and could be subject to a lot of financial pain, a lot of reputational harm.”

Steps to Take Before a Ransom Demand

In addition to creating a cyber team, bringing on a skilled negotiator and understanding what’s at stake, there are several other ways companies can prepare for the cyber ransom payment decision.

Larson suggested looking into the concept of a prep room.

“It’s a secure space in which an organization can prepare for a cyber incident by inviting their own incident response team members and establishing a secure communications platform” she said.

“It also allows them the opportunity to upload critical documents such as a business continuity plan or incident response plan outside of their corporate network. If they’ve got a bad actor in their system, they don’t want to be exchanging sensitive information such as insurance policy documents via email.”

Companies should also be investing resources into training employees to spot phishing attempts, which account for 90% of all data breaches, according to Cisco’s 2021 Cyber Security Threat Trends report.

Finally, another step pre-attack to take is to review best practices on how to approach a breach after a hacker is already in the system. Knowing what to do well before an event can and will go a long way in protecting the business from long-tail financial and reputational harm.

“Companies should not overlook basic cyber hygiene, and they should always be striving to be as optimal as they can,” said Larson.

Dan Zeiler

dan@zeiler.com

877-597-5900 x134