To Pay or Not to Pay? What to do when you get hit by Ransomware

Ransomware Response

But what happens when you do get hit by ransomware?

You won't have the luxury of time to bring all your stakeholders together to make critical business decisions. You can control the panic and chaos with process. Outline this process as part of your organization's business continuity plan.
Once the ransomware is discovered, your crisis management team isolates the malware, assesses the damage, and investigates how the threat actors got in. The next step is to change all user and service account passwords and log everyone out. After that, asset restoration can begin. This action plan is for those who maintain an updated business continuity plan and have solid data backup and disaster recovery solutions in place.

Organizations with limited resources to invest in cybersecurity are more susceptible to ransomware attacks. 2021-2022 taught us that hackers have found that attacks on school districts, critical infrastructure, financial institutions, local governments, and hospitals can be highly lucrative. Cyber-weak organizations that are under-resourced and unprepared often pay the ransom to restore their operations only to find that recovery costs far exceed the ransom demand. A single data breach can destroy IT projects, consumer trust, investments, and M&A opportunities.

What you expect when you pay the ransom:

1. Get your data back & resume operations
2. Hackers delete your data
3. Your customers won’t notice
4. You won’t attract the attention of government regulators
5. You won’t get hacked again because lightening doesn’t strike the same spot twice

What actually happens when you pay the ransom:

1. You might not get any/all of your data back
2. The decryption key doesn’t work, or the files are corrupted
3. Data may have been or will be sold on the dark web or published on a public forum
4. You are now a target for more attacks and double extortion
5. OFAC can inflict civil penalties on the payor for engaging with a terrorist
6. You are putting other organizations at risk by funding more attacks.
7. If business disruption was the hacker’s primary motivator, paying is a total loss

Payment of a ransom demand does not guarantee anything. How could you trust a hacker? How could you ever know if your data is truly deleted? Focus your energy and resources on building cyber resilience and data protection.

Stop Playing the Victim – Build Cyber Resilience

Marketing agencies operate on the premise that 'all attention is good attention.' But that does not ring true for cyberattack victims. If your company is in the news as the poster child for what not to do, all those headlines and "free advertising" only serve to devalue your organization.

While no one is immune to an attack, the court of public opinion is ruthless, and security expectations seem impossibly high. Only 38% of business leaders are confident in their organization's cyber resilience. The other 62% either don't have the resources or don't see IT as a core business function.

So how can you save your image and your business? By acting decisively, communicating with transparency, and implementing disaster recovery plans quickly, you can build trust in your leadership capabilities and consumer protection goals. If you can prove that you have complied with CISA's 2020 Ransomware Guide and are promoting best practices to secure your organization, then you are better prepared to defend both your business and your personal accountability.

Controlling the narrative is essential. But you'll need to fully integrate risk management strategies across operations by securing your perimeter offensively and defensively with an Extended Threat Detection and Response (xTDR) solution. Also focus on creating immutable data backups and understanding the costs associated with data recovery timelines.