Study: More than Half of Ransomware Victims pay, but Many Remain Empty-Handed

More than half (56%) of ransomware victims paid the ransom to restore access to their data last year, according to a global survey of 15,000 consumers conducted by global security company, Kaspersky. Yet for 17% of the people who paid, that did not guarantee the return of their stolen data.

Kaspersky’s report, “Consumer appetite versus action: The state of data privacy amid growing digital dependency,” highlights consumer experience with this growing cyber threat.

The percentage of victims who paid the ransom to restore access to their data last year was highest among those aged 35-44; with two-thirds (65%) having paid. That compares to just over half (52%) of those aged 16-24 and only 11% of those over the age of 55.

 Whether they paid or not, only 29% of all victims were able to restore all their encrypted or blocked files following an attack. Half (50%) lost at least some files, 32% lost a significant amount, and 18% lost a small number of files. Meanwhile, 13% who did experience such an incident lost almost all their data.

“This data shows we have seen a significant proportion of consumers paying a ransom for their data over the past 12 months,” said Marina Titova, Head of Consumer Product Marketing at Kaspersky. “But handing over money doesn’t guarantee the return of data, and only encourages cybercriminals to continue the practice. Therefore, we always recommend that those affected by ransomware do not pay as that money supports this scheme to thrive. Instead consumers should make sure to invest in initial protection and security for their devices and regularly back up all data. This will make the attack itself less appealing or lucrative to cybercriminals, reducing the use of the practice, and presenting a safer future for web users.”

Kaspersky recommends against paying if a device has been locked. Paying ransoms only encourages cybercriminals to continue their practice. Instead, contact your local law enforcement agency and report the attack. Try to find out the name of the ransomware Trojan. This information can help cybersecurity experts decrypt the threat and retain access to your files, given that experts may have run into exploits using the same malware. Backing up your devices is also an important practice.

Channel Impact^®
Channel partners should leverage this data as a means of helping customers to minimize their risk.