Ransomware Surge Pushes Victims to Pay Up Amid Sophisticated AI-Powered Attacks

Despite the increasing sophistication, the question of whether to pay remains divisive. Jim Walter, a senior threat researcher at SentinelOne, advocates for a strict stance against paying ransoms, arguing that it strengthens the ransomware ecosystem and that threat actors cannot be trusted to delete data upon payment. He emphasizes that paying does not guarantee data recovery and encourages further crime.

Others, like Andy Maus, head of cyber recovery services at DriveSavers, express concern about payment bans when data recovery is not feasible. Maus argues that situations are often more nuanced than a ban allows for, especially for critical infrastructure like water or power providers, where failure to recover data could have severe consequences for customers. He points to North Carolina and Florida, where statewide bans introduced in 2021 and 2022 respectively, do not appear to have materially deterred criminal activity.

Brooks of Risk Ledger warns that if public bodies are banned from paying, cyber criminals will "aggressively pivot" to the less regulated private sector. This shift could also impact the cyber insurance market, potentially driving premiums higher as costs exceed original ransom demands. The market now offers services like ransom negotiators and incident response teams to support companies. Maus suggests that factors such as the type of data stolen (personally identifiable or sensitive health information) and the responsible threat group should influence decisions on payment versus recovery.

Gavin Millard, vice-president of product at Tenable, suggests that the more critical question is how to make ransomware less profitable. He notes that most attacks exploit familiar vulnerabilities and security gaps, highlighting the importance of "exposure management." Walter at SentinelOne stresses the need for companies to be aware of emerging threats and maintain proper technical hygiene, including continuous device monitoring and multi-factor authentication. Spencer Young of Delinea emphasizes visibility over internal systems and limiting access to shrink the "blast radius" of attacks.

Some experts advocate for innovative government support, such as investing in subsidized backup infrastructure or offering tax incentives for cybersecurity spending, as more effective measures to reduce underlying exposure than prohibiting payments after an attack has occurred.