Interesting report from Emsisoft about the ransomware industry. They company is joining a number of voices calling for the ban on ransom payments, in the hope that doing so would make the venture less profitable for criminals. The problem I see here, as mentioned in the report and across the internet, is that some organizations would pay anyway, no matter what the law says.
However, the other side is this. Criminals turned to crypto currency as a means of convivence. They would just find another way to profit. The problem won’t slow or go away in my opinion, because one of the drivers is access and how easy it is to not only target victims, but also get involved in the ransomware trade.
Read the whole report, link below, because it is certainly worth the time.
Source: Emsisoft
The United States faced a severe ransomware crisis in 2023, with 2,207 hospitals, schools, and government entities directly impacted and thousands of private companies affected either directly or indirectly, according to a report from Emsisoft.
The report suggests that ransomware is not only a significant economic burden but also a risk-to-life threat, estimating that ransomware attacks caused the death of between 42 and 67 Medicare patients from 2016 to 2021.
The severity of the crisis is underlined by the numbers: 46 hospital systems, 108 K-12 school districts, 72 post-secondary schools, and 95 government bodies reported ransomware attacks in 2023. The average cost to recover topped $1.5 million per incident.
The report argues for a complete ban on ransom payments as the only viable solution to quickly reduce ransomware volumes. This stance is supported by security experts like Kevin Beaumont and Allan Liska, who highlight that ransomware is a profit-driven enterprise and banning payments would make it unprofitable.
Emsisoft’s Brett Callow also supports a ban, criticizing current counter-ransomware strategies as ineffective. The report acknowledges the challenges in implementing a ban, such as the potential for attackers to pivot to other forms of cybercrime, and the likelihood that some organizations might break the law and pay ransoms anyway. However, it argues that a ban would stop enough payments to make ransomware unprofitable.
Mandiant’s Jeremy Kennelly told The Register that a universally enforced ban on ransomware payments would be difficult to implement and enforce. He notes that ransomware is just one of many tools used by criminals for extortion, indicating a need for a broader approach to tackling the issue.
The economic impact of ransomware is significant, with $449 million in ransoms paid in the first six months of 2023 alone. The cost to the U.S. economy is estimated to be in the billions, including business disruptions and post-breach expenses. The report also highlights the overall escalation in the tactics used by threat actors.
In conclusion, the report emphasizes the need for governments to understand the conditions that have allowed ransomware to become such a significant threat and to consider effective legislative responses to future threats. The dramatic increase in ransom demands and the evolving nature of attacks underline the urgency for decisive action.