Ransomware attacks are a growing threat, with global damage costs predicted to exceed $265 billion by 20311. Recently, a hacking group disrupted over 230 of Indonesia’s government agencies, demanding a modest $12 million ransom. This incident highlights a critical question:

Should organisations pay the ransom?

The Cost of Compliance vs. Defiance

Paying the ransom can seem like a quick fix, but it doesn’t guarantee data recovery or prevent future attacks. In Australia, 73% of organisations that faced ransomware attacks in the past five years chose to pay. However, the Australian government strongly advises against this, citing risks of data not being recovered and potential legal repercussions.

Legal and Ethical Considerations

Paying a ransom could breach Australian sanctions laws and potentially constitute a money laundering offence. The government is pushing for mandatory reporting of ransomware incidents to improve national resilience and understanding of cybercrime.

Proactive Measures

Organisations must prioritise preparedness. This includes keeping systems updated, developing robust backup strategies, staff awareness training and conducting thorough audits post-attack. The standard approach to ransomware is evolving, and companies must adapt to mitigate risks effectively.

Conclusion

While the temptation to pay a ransom is strong, the long-term consequences and legal risks make it a less viable option. Instead, investing in preventive measures and adhering to government guidelines can help build a more resilient defence against ransomware.

Reference: Ransomware Attacks Are Attracting Record Payouts in Australia. Should You Pay the Ransom? (techrepublic.com)