3 ms·

Why did they agree to pay the ransom? Such a small org it seems like they could rebuild the systems they needed for less than $1mil?..

rexreed 2y ago
That's also my question. In general, can someone explain why offsite, offline, multi-timescale backups don't help in these cases? Yes I get that insurance paid the extortion, but besides just capitulating, why doesn't restoring from backup work, assuming you can spot the vulnerability that caused the ransomware attack?
loandbehold 2y ago
Their insurance covered ransom. Why on the earth does insurance cover ransom? Doesn't it encourage such attacks? Ideally paying ransom should be illegal as it just funds further attacks.
- selectodude 2y ago
  Insurance companies will see if it was a novel targeted hack that really couldn’t have been stopped vs laziness and poor security hygiene in which case they will cover less.
- II2II 2y ago
  Would it stop ransomware attacks, or is it another one of those situations where the cost of launching an attack is so low that you only need an insignificant number of desperate victims to pay in order to profit? I am also left to wonder if paying helps the investigation.
  - loandbehold 2y ago
    I'm sure it would reduce ransomware attacks by an order of magnitude. These are not simple attacks and the cost to launch them isn't that low. It requires large effort from groups of smart people to penetrate these corporate networks and it's time-consuming for attackers. The opportunity cost for these smart people is high, most of them can get a high paying job. The reason these attacks persist is because it's so lucrative. These's definitely a break even point for attackers. If 80% of ransom payments are stopped the attacks will stop because it will no longer be profitable for attackers.
- BobbyTables2 2y ago
  Why wouldn’t an insurance company want to keep 20% of premiums covering ransom payments ? They stand to loose future premiums if paying ransoms is NOT broadly seen as a viable option. Sure, in the short term, they hate customers that make a lot of claims. But those claims, in aggregate, are the fuel for their 20% skimming… If nobody paid ransom, why would they want insurance coverage? And if no insurance covered it, they wouldn’t be able to skim off the corresponding premiums…
- jrexilius 2y ago
  You are touching on my thoughts exactly. It seems everyone would come out better if the insurance company just paid for them to rebuild. I suspect that'd come out cheaper and it would maybe deter the attacks by making them worth less..
firesteelrain 2y ago
It’s light on details but perhaps there was data that was not easy to recover. We also have to consider the rebuild labor and if entire systems are corrupted then repurchasing new systems.

rexreed 2y ago

That's also my question. In general, can someone explain why offsite, offline, multi-timescale backups don't help in these cases? Yes I get that insurance paid the extortion, but besides just capitulating, why doesn't restoring from backup work, assuming you can spot the vulnerability that caused the ransomware attack?

loandbehold 2y ago

Their insurance covered ransom. Why on the earth does insurance cover ransom? Doesn't it encourage such attacks? Ideally paying ransom should be illegal as it just funds further attacks.

selectodude 2y ago
Insurance companies will see if it was a novel targeted hack that really couldn’t have been stopped vs laziness and poor security hygiene in which case they will cover less.
II2II 2y ago
Would it stop ransomware attacks, or is it another one of those situations where the cost of launching an attack is so low that you only need an insignificant number of desperate victims to pay in order to profit? I am also left to wonder if paying helps the investigation.
- loandbehold 2y ago
  I'm sure it would reduce ransomware attacks by an order of magnitude. These are not simple attacks and the cost to launch them isn't that low. It requires large effort from groups of smart people to penetrate these corporate networks and it's time-consuming for attackers. The opportunity cost for these smart people is high, most of them can get a high paying job. The reason these attacks persist is because it's so lucrative. These's definitely a break even point for attackers. If 80% of ransom payments are stopped the attacks will stop because it will no longer be profitable for attackers.
BobbyTables2 2y ago
Why wouldn’t an insurance company want to keep 20% of premiums covering ransom payments ? They stand to loose future premiums if paying ransoms is NOT broadly seen as a viable option. Sure, in the short term, they hate customers that make a lot of claims. But those claims, in aggregate, are the fuel for their 20% skimming… If nobody paid ransom, why would they want insurance coverage? And if no insurance covered it, they wouldn’t be able to skim off the corresponding premiums…
jrexilius 2y ago
You are touching on my thoughts exactly. It seems everyone would come out better if the insurance company just paid for them to rebuild. I suspect that'd come out cheaper and it would maybe deter the attacks by making them worth less..

firesteelrain 2y ago

It’s light on details but perhaps there was data that was not easy to recover. We also have to consider the rebuild labor and if entire systems are corrupted then repurchasing new systems.