A new study shows that a majority of smaller businesses would acquiesce and pay to have their data released in a case where they were hit with a ransomware attack and could not recover the data on their own.
The cloud security company AppRiver’s Q2 Cyberthreat Index for Business Survey found that 55 percent of 1,035 smaller business, those with fewer than 250 employees, would pay a cyberattacker in order to recover their data. This figure jumps to 74 percent among companies at the higher end of this spectrum -- 150 to 250 employees. Of that cohort, 39 percent said they would definitely pay a ransom of almost any price to prevent their data from being leaked or lost.
The sectors that are most willing to pay were technology, financial and insurance, government, and telecom.
“A possible explanation is that financial, government, tech and telecom have the resources to pay; they also have the most to lose if their reputation is hit by news of a cyber breach. The recent payroll hacking on the city of Tallahassee and the March 2018 ransomware attack on the city of Atlanta were both estimated to have cost the local governments millions in data system repair and PR damages,” according to Geoff Bibby, vice president of marketing for Zix, AppRiver’s parent company.
However, 45 percent of those surveyed reported that they would not pay any ransom. Those in legal, health care and the non-profit sectors are least willing to pay a ransom, with 67, 60 percent and 55 percent, respectively, stating they will not engage with cybercriminals regardless of the ransom amount or value of the stolen data.
“Legal professionals could be least willing to pay because they are more aware of the legal ramification of complying with criminals. Non-profits may not have the resources to pay; they also potentially have the least to lose as victims of a cyber breach. They could gain sympathy from being hacked, and it is fair to assume that their supporters would not expect them to have the most advanced tech resources for cybersecurity,” AppRiver said.
There is also a geographic element as well. More SMBs in Boston and New York City (65 percent and 66 percent, respectively) are willing to pay than those based in Los Angeles and Washington, D.C.
“It is possible that the high concentration of legal and non-profit SMBs in D.C. is partially responsible for the lower propensity among the market’s SMBs to want to comply with cybercriminals by paying ransom. In contrast, the higher concentration of financial services and technology SMBs in Boston and NYC could explain the higher degree of willingness to pay ransom in the market,” the survey noted.
