Most Businesses Pay Ransomware Demands, IBM Finds (eweek.com)

According to an IBM Security report released on December 14, 70 percent of businesses impacted by ransomware end up paying the attackers. The amount varies but a majority of business respondents said they paid tens of thousands of dollars. eWeek reports: The 23-page IBM Security study surveyed 600 business leaders and 1,021 consumers in the U.S. 46 percent of business respondents reported that they had experienced ransomware in their organizations. Of the 46 percent that have been impacted by ransomware, 70 percent admitted that their organization paid the ransom. The amount paid to ransomware attackers varies, but of those business respondents that paid a ransom, 20 percent paid over $40,000, 25 percent paid between $20,000 and $40,000 and 11 percent paid between $10,00 to $20,000. On the consumer side, IBM's study found that the propensity to pay a ransom varies depending on whether or not the victim is a parent. 55 percent of consumers that identified themselves as being parents said they would pay a ransom to recover access to photos that had been encrypted, versus only 39 percent for consumers that don't have children. In an effort to help organizations respond quickly to ransomware threats, IBM's Resilient Incident Response Platform (IRP) is being enhanced with a new Dynamic Playbook for ransomware. Ted Julian, Vice President of Product Management and Co-Founder at Resilient, an IBM Company, explained that the basic idea behind the Dynamic Playbooks is to help provide organizations with an automated workflow or 'playbook' for how to deal with a particular security incident.

Comments

The unwritten part of the headline...

[Anonymous Coward]

Most companies dont have a backup regimen.

Re:The unwritten part of the headline...

[donaldm]

Most companies dont have a backup regimen.

It would be more appropriate to say "Most companies don't have a disaster recovery plan" and/or don't test it out which is actually the most important part of a disaster recovery plan.

The problem with paying extortion demands and ransomeware demands are extortion, only encourages these criminals to go after more lucrative targets with more sophisticated attack methods especially when their targets are willing to pay and pass on their incompetent loss of money to their customers or shareholders.