Over the past decade, the average value of ransoms demanded by hackers has gone from hundreds of dollars to hundreds of thousands — even into the millions in some cases. With increasingly stringent regulatory requirements and CISOs being sued for not reporting a breach, the stakes of ransomware attacks are getting ever higher. But specialists say enterprises can avoid getting into such situations in the first place by creating incident response plans, improving their cybersecurity posture, and investing in robust backups of both data and infrastructure.
In 2018, Shelley Ma, incident response lead at Coalition, was in a conversation with the executive and technical teams of a company that had just been hit by ransomware. The attack brought the company to a standstill and the ransom was $200,000. “The CEO said, ‘I’m losing $1 million a day. $200,000 for me is chicken feed. So pay it — just pay it,” Ma recalls.
In 2015, when she first started dealing with ransomware, most companies paid and the ransoms were usually just a couple hundred dollars. Over time, they’ve gotten larger and now are exorbitant, she says. “We very rarely would see a ransom south of $300,000. Most are in the six figures and quite frequently in the seven or eight figures, too.”
