Get a demo

We can say it until we are blue in the face, “Do not pay the ransom, ever. Period." Even when your small or medium-sized business (SMB) is the victim of a ransomware attack, do not pay the hackers.

Paying the ransom only leads to more problems for your organization in the long term. It is a short-sighted strategy that does not guarantee you will get your data back and encourages hackers to attack you again. Yet, despite these warnings, cyber insurance companies and others have encouraged companies to pay the ransom, as a quick means to restore operations. We need to cover the consequences again and help victims avoid paying a ransom twice.

Federal Bureau of Investigation (FBI) Ransomware Recommendation

"The FBI does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data. In some cases, victims who paid a ransom were never provided with decryption keys. In addition, due to flaws in the encryption algorithms of certain malware variants, victims may not be able to recover some or all their data even with a valid decryption key. Paying ransoms emboldens criminals to target other organizations and provides an alluring and lucrative enterprise to other criminals." – FBI, Internet Crime Compliance Center

Even if the bad guys were to give you a key that actually unlocks your systems (which is not guaranteed—criminals are not the most trustworthy people), you do not know what copies of the data exist or who might now have access to it. Your systems might still harbor latent malware or other infections that make you vulnerable to repeated attacks. Because the hackers know you will pay up, you are going to get hacked again. Like any business, ransomware hackers love repeat customers. Do not listen to insurance providers who think they can save money when you pay a ransom.

It helps to think of this as a kind of business model that hackers are using. They identify their best customers (i.e., people who pay them ransoms) and then work to garner a greater share of that customer’s wallet. When you pay up, you are going to get hacked again.

Already Paid A Ransom, What Should You Do Next?

Avoid paying ransoms again. Start by admitting you have an ongoing cybersecurity problem. The hackers are coming back. 95% of the time when you get robbed, you get hit again after you have replaced all your stuff. Ransomware is not like some one-and-done art theft. After you have paid a ransom, the hackers will be back for more money.

So, get ready for the bad guys’ return; find out how they got into your information technology (IT) network system. Do a root cause analysis, including:

  • Is your business cybersecurity lax?
  • Does the firewall have vulnerabilities?
  • Did an employee fall victim to a phishing email?

Next, identify where the hackers originate by tracking the Internet Protocol (IP) address used to launch the attack. Close that loop by blocking said IP. As an added precaution, set your firewall to block IPs from any geographies where you are not doing business. Test these new defenses to make sure they work and will prevent the bad guys from coming back.

When it comes time to validate these steps work, you need to have business interruption (BI) / disaster recovery (DR) plans in place. BI/DR plans ensure business continuity and your ability to replace lost data from backups.

Prepare a well-defined incident response (IR) plan that enable you identify attacks, minimize the damage, and reduce the cost of a cyberattack. Train your people what to do and what not to do in the event of a cyberattack. Then, test them regularly (like in a fire drill). Think carefully about whether your organization can implement these steps. Are you sufficiently staffed to do this on your own? You probably need outside help to defend your business.

Check out our white paper, The Rise of Ransomware-as-a-Service for more information on steps to mitigate ransomware. 

End Ransom Demands Now

Have you suffered ransomware infections in the past, or are you facing a ransom demand right now? Then call ActZero today at 1-855-917-4981. We offer incident response services to our small and medium-sized clients. In addition, our managed detection and response (MDR) service proactively protects against ransomware attacks. Stop suffering and call now!

For more information on the latest ransomware threats, check out our white paper.

Citations
Topic:

Related Resources

Cybersecurity Industry Threat Intelligence Ransomware Data Protection

Ransomware: The Persistent Cyber Threat and How to Combat It

Ransomware attacks are a growing concern, especially for schools and small businesses. The latest CrowdStrike 2024 Global Threat Report reveals a staggering 75% year-over-year increase in cloud environment intrusions, showing that ransomware isn’t just sticking around — it's evolving. Schools and
         
Cybersecurity Industry Data Protection Education

Ransomware Prevention Guide for Schools and Small Businesses

Ransomware continues to be a growing threat, particularly for schools and small businesses with limited IT resources. This guide outlines essential steps to help your organization safeguard against these attacks.
         
Cybersecurity Industry Data Protection Education

Cyber Smarts For Schools & SMBs: Your Cheat Sheet to Staying Safe Online

Your Guide to Staying Safe Online— Without All the Jargon. Here are 10 cybersecurity tips every employee should know to keep your organization safe from cyber villains.
         
Security Hygiene C-Suite Accountability Data Protection

How Compromised Employee Credentials Put Your Organization’s Security at Risk

Taking proactive steps to secure your digital assets is essential. A common, yet often overlooked threat is the exposure of sensitive information on the dark web. But what exactly does this mean, and how can it impact your organization?
         
Security Hygiene Data Protection

The Art of the Uncrackable Password: Tips from the Cybersecurity Frontline

Passwords are your first line of defense in the cyber world. Yet, many of us still use passwords that a determined hacker could crack over a cup of coffee. Let's explore some actionable ways to create stronger passwords and secure your digital life.
         
Cybersecurity Industry Cybersecurity News Data Protection

Top 5 Abuses of AI

With AI investments soaring, evidenced by the AI 100 raising $28 billion in venture capital deals and Nvidia becoming the world's most valuable company in June, we are undoubtedly in the summer of AI. The rapid growth of AI companies, along with 700,000 open-source models and 150,000
         
Cybersecurity Industry Data Protection Education

Harnessing AI to Combat Cyber Threats to Protect Student Data

As technology integrates deeper into the curriculum, the responsibility of protecting sensitive data and ensuring a secure learning environment rests heavily on the shoulders of tech directors. In an era where attackers are employing sophisticated AI tools to enhance their tactics, school district
         
Cybersecurity Industry Data Protection

Why Every Minute Matters in Cybersecurity: The Economics of Fast Incident Response

Small businesses find themselves disproportionately vulnerable to cyberattacks, accounting for a staggering 82% of all breaches in 2023. The staggering statistics reveal the reality: an average user contends with around 1.5 malicious emails and witnesses the compromise of 30,000 small
         
Cybersecurity Industry Threat Intelligence Data Protection

Hygiene Tip: Shut Down Attackers Harvesting Cached Browser Credentials

Recently, ActZero learned that ransomware actors are harvesting credentials from browsers during their attack. In recent attack chains our threat researchers have seen that, once the attacker gains a foothold, they are using Living-off-the-Land (LoTL) attacks to harvest the cached credentials from
         
Cybersecurity Industry Data Protection

Achieving Unity Across Piecemeal Cybersecurity Solutions

Have you inherited a cybersecurity program with many different tools? Do they offer little in the way of measurable outcomes that show your program is more effective today than it was last month?
         

Curious about how ActZero can evolve your cybersecurity strategy?

Get a demo Contact Us