Greedy ransomware crews return for seconds after victims cough up first extortion payments
Some never saw their files again either, infosec biz Proofpoint finds
Authorities have long warned organizations not to pay ransoms, and fresh figures underline why: handing over the money doesn't mean the crooks leave you alone.Proofpoint survey data suggests that 58 percent of affected UK organizations paid a ransom. Worse, 22 percent of those who pay get extorted again anyway. The UK broadly tracks the global picture: 54 percent of victim organizations paid, though the rate swings sharply by region, from just 19 percent in Japan to 93 percent in the US.
Cybersecurity biz Proofpoint, which published the data on Wednesday, attributes the regional variation to "a combination of regulatory environment, recovery capability, insurance incentive structures, and cultural norms around negotiation."
"But the core finding holds everywhere: ransomware creates enough pressure that a significant share of organizations in each of the surveyed markets choose to pay."UK organizations that paid fared somewhat better than the 37 percent global average for repeat extortion. Still, the core lesson stands: paying doesn't reverse an attack. You can't trust a criminal's word. It just restarts a negotiation where the attacker holds every card, including the data, decryption keys, and the threat of publishing what they've stolen.Operation Cronos, law enforcement's LockBit takedown, provided hard proof of what had long been suspected: cybercriminals often retain victim data even after being paid. Before Dmitry Khoroshev's cybercrime empire collapsed, this was an assumption, not evidence-based.
