4 ms·

Bad idea to guarantee the improbable (deleting their own copies), a valid choice for a one-time result (unlocking your data on your device).

autoexec 3y ago
That's typically what backups are for. No business should be so negligent as to ever need to pay a ransomware group in order to get their own data back.
- nonethewiser 3y ago
  But if they are, it may make sense to pay. For the company. Not from a more macro view.
  - autoexec 3y ago
    That I can agree with. If the company has already screwed up so badly they're stuck paying the price and hoping for the best.
- pants2 3y ago
  It may also be about not wanting their data to be made public.
  - danlugo92 3y ago
    Yeah...
- irjustin 3y ago
  In this case I would include "getting their systems back online"
  - autoexec 3y ago
    There could be times when there's an immediate need to get everything back up and running, but I'd be willing to bet that in at least some situations the time spent going back and forth with the extortionists to arrange the payment, then gather the funds, and then wait for them the verify that they have your money could take longer than it would to just re-image a new server, reset some passwords, and copy over the needed data from backups. It's the same stuff they'd have to do either way. My guess is that companies that have their shit together enough that they could get back to a "We're total compromised and vulnerable, but at least we're online for now" state fairly quickly without paying up are a lot less likely to have ransomware problems in the first place.
- wlonkly 3y ago
  As a data point, the Toronto Public Library decided to take the "restore from scratch" approach after being hit by ransomware, and it took four months before books could be borrowed again. Now, I'd expect a library would move slower than an IT-heavy company, but there are substantial costs either way and only one of them is probably covered by their cyber insurance.
  - danlugo92 3y ago
    Four months wtf, they should have offsite backups maybe every 15 days at most, but I can understand how even that can be a headache to restore from...
  - ornornor 3y ago
    So that’s what happened. I was wondering why they were having so much trouble. Their wording was evasive and I thought I til now that it was Covid closures related somehow without really understanding how covid would have that impact.

autoexec 3y ago

That's typically what backups are for. No business should be so negligent as to ever need to pay a ransomware group in order to get their own data back.

nonethewiser 3y ago
But if they are, it may make sense to pay. For the company. Not from a more macro view.
- autoexec 3y ago
  That I can agree with. If the company has already screwed up so badly they're stuck paying the price and hoping for the best.
pants2 3y ago
It may also be about not wanting their data to be made public.
- danlugo92 3y ago
  Yeah...
irjustin 3y ago
In this case I would include "getting their systems back online"
- autoexec 3y ago
  There could be times when there's an immediate need to get everything back up and running, but I'd be willing to bet that in at least some situations the time spent going back and forth with the extortionists to arrange the payment, then gather the funds, and then wait for them the verify that they have your money could take longer than it would to just re-image a new server, reset some passwords, and copy over the needed data from backups. It's the same stuff they'd have to do either way. My guess is that companies that have their shit together enough that they could get back to a "We're total compromised and vulnerable, but at least we're online for now" state fairly quickly without paying up are a lot less likely to have ransomware problems in the first place.
wlonkly 3y ago
As a data point, the Toronto Public Library decided to take the "restore from scratch" approach after being hit by ransomware, and it took four months before books could be borrowed again. Now, I'd expect a library would move slower than an IT-heavy company, but there are substantial costs either way and only one of them is probably covered by their cyber insurance.
- danlugo92 3y ago
  Four months wtf, they should have offsite backups maybe every 15 days at most, but I can understand how even that can be a headache to restore from...
- ornornor 3y ago
  So that’s what happened. I was wondering why they were having so much trouble. Their wording was evasive and I thought I til now that it was Covid closures related somehow without really understanding how covid would have that impact.