Ransomware: It’s sometimes best to pay up

New York: Companies hit by ransomware are faced with an ethical dilemma: pay up to save their now-encrypted data, or hold the moral high ground and lose it all.

This is a question many companies may have to face. The recent WannaCry cyber-attack, which targeted the data of organisations including UK hospitals, is part of a growing and lucrative “industry”.

In most cases, the perpetrators attempt to encrypt a business’s data and then refuse to share the decryption key unless a ransom is paid. WannaCry reportedly demanded that companies pay upwards of US$300 in Bitcoin.

Of course, there are ways to protect yourself. Up-to-date software and effective backups are good controls for ransomware, but many people fail to keep up. For examples, an estimated 7% of computers globally still use Windows XP software, despite Microsoft having ended support for the platform. In the case of WannaCry, this was an important vulnerability.

Paying up may be the rational choice for an individual business, but given that cybercriminals go where the money is, the repercussions for others could be significant. Pop-culture morality tells us a ransom should not be paid; movies tell us that paying the ransom means the bad guys win.

In the real world, however, businesses faces a serious dilemma. Paying the ransom could save the business and keep staff employed, but the cybercriminal will probably feel encouraged to continue their attacks. Ultimately, businesses held to ransom have at least four choices:

Refuse to pay the ransom and risk the possibility that criminals will carry out threats call authorities to launch a criminal investigation, although whether the data will be decrypted is uncertain attempt to use decryption tools to access the data.