4 ms·

> With a U.S. population of ~200M, let’s call it 4M infections/year. We know that 4% of respondents paid the ransom, so that’s 160,000 ransom payments. If we sa

> With a U.S. population of ~200M, let’s call it 4M infections/year. We know that 4% of respondents paid the ransom, so that’s 160,000 ransom payments. If we say $200 per paid ransom as a guess, that means the ransomware ‘industry’ is making about $32M a year. The U.S. population is actually ~327M, but since we're talking ballpark figures, let's just say that ~200M represents the adult computer-using population. It strikes that ransomware is both much bigger and much smaller than I thought. The 160,000 ransom payments is much bigger than I would have guessed. It's not like being struck by lightning; it's more like a serious car accident. But the actual revenue generated, $32M as he's estimated, is pitiful. There are all sorts of illegal, quasi-legal, and legal ripoffs that generates billions per year. For the amount of attention ransomware gets, it's just noise.

mannykannot 7y ago
The attention seems to be due to two factors: the high-profile cases that hit large organizations like school districts, local government or hospitals (which are not affected by common scams), and the relative novelty of using cryptocurrency for paying the ransom (though not predominantly, according to this survey; I would guess that using cryptocurrency reduces the yield from the individual users that are the common victims.)
Frye 7y ago
For now it may be just noise, but the ransoms are quickly getting bigger and bigger. Last month I facilitated the payment of 3 BTC to decrypt the files.
- celticninja 7y ago
  I imagine these sort of attacks are more like spear phishing, in that they look for high value targets. No one is paying $25k for the family laptop files, but a medium sized business,perhaps digital in nature, would be quick it pay that price to fix the problem.
sp332 7y ago
Ransomware can be hard to trace, which keeps risk low, and that means criminals can afford to ask for less money. It's also a benefit to keep the ransoms small enough that people will pony up instead of getting the FBI involved.
est31 7y ago
As with most criminal activity, the damage created by it is much larger than the money made. I couldn't find any US figures, but global estimates claim ransomware-caused damages of 11.5 billion USD in 2019: https://cybersecurityventures.com/ransomware-damage-report-2017-part-2/ https://cybersecurityventures.com/ransomware-damage-report-2...
- dhruvmittal 7y ago
  I'm guessing the damage numbers are higher because of a number of high-impact city-focused attacks. I live in Baltimore, where all of the city's systems were shut down for a few months over a ransomware attack asking for <100k. A similar attack occurred last year in Atlanta; wikipedia quotes a demand of 50k & Atlanta estimated around 10M in contractors for recovery. https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_atta...
  - Bartweiss 7y ago
    Long-tail damage to governments and hospitals is definitely part of it - there's very little upper bound on how much ransomware can cost if you botch the response badly enough. And given how much ransomware simply doesn't decrypt if you pay, there's no reason the ransom prices should have any real correlation to the damage inflicted. The other part of it appears to be some slightly funny calculations. If ransomware shuts down Target's online store for a day, Target might compute the loss based on 24 hours of no revenue, but purchases that go to Amazon, or to Target a day later, shouldn't be added into total "damage". The dollar value being computed there is something more like disruption.
- codemac 7y ago
  This was calculated by Cisco & Cybersecurity Ventures, who both directly profit from the fear generated by these figures. I do not trust these figures. This is marketing for CIO/CISO's to read so they make sure to add in various security features to their BoM for purchase.
deleted 7y ago
[deleted]
downrightmike 7y ago
Now that there is insurance for ransom ware, The insurers are usually paying the criminals, which will only lead to more attacks.

mannykannot 7y ago

The attention seems to be due to two factors: the high-profile cases that hit large organizations like school districts, local government or hospitals (which are not affected by common scams), and the relative novelty of using cryptocurrency for paying the ransom (though not predominantly, according to this survey; I would guess that using cryptocurrency reduces the yield from the individual users that are the common victims.)

Frye 7y ago

For now it may be just noise, but the ransoms are quickly getting bigger and bigger. Last month I facilitated the payment of 3 BTC to decrypt the files.

celticninja 7y ago
I imagine these sort of attacks are more like spear phishing, in that they look for high value targets. No one is paying $25k for the family laptop files, but a medium sized business,perhaps digital in nature, would be quick it pay that price to fix the problem.

sp332 7y ago

Ransomware can be hard to trace, which keeps risk low, and that means criminals can afford to ask for less money. It's also a benefit to keep the ransoms small enough that people will pony up instead of getting the FBI involved.

est31 7y ago

As with most criminal activity, the damage created by it is much larger than the money made. I couldn't find any US figures, but global estimates claim ransomware-caused damages of 11.5 billion USD in 2019: https://cybersecurityventures.com/ransomware-damage-report-2017-part-2/ https://cybersecurityventures.com/ransomware-damage-report-2...

dhruvmittal 7y ago
I'm guessing the damage numbers are higher because of a number of high-impact city-focused attacks. I live in Baltimore, where all of the city's systems were shut down for a few months over a ransomware attack asking for <100k. A similar attack occurred last year in Atlanta; wikipedia quotes a demand of 50k & Atlanta estimated around 10M in contractors for recovery. https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_atta...
- Bartweiss 7y ago
  Long-tail damage to governments and hospitals is definitely part of it - there's very little upper bound on how much ransomware can cost if you botch the response badly enough. And given how much ransomware simply doesn't decrypt if you pay, there's no reason the ransom prices should have any real correlation to the damage inflicted. The other part of it appears to be some slightly funny calculations. If ransomware shuts down Target's online store for a day, Target might compute the loss based on 24 hours of no revenue, but purchases that go to Amazon, or to Target a day later, shouldn't be added into total "damage". The dollar value being computed there is something more like disruption.
codemac 7y ago
This was calculated by Cisco & Cybersecurity Ventures, who both directly profit from the fear generated by these figures. I do not trust these figures. This is marketing for CIO/CISO's to read so they make sure to add in various security features to their BoM for purchase.

deleted 7y ago

[deleted]

downrightmike 7y ago

Now that there is insurance for ransom ware, The insurers are usually paying the criminals, which will only lead to more attacks.