Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / The Price of Ransomware: Payouts and Negotiation Tactics
Transcript
- Lucas: So there's this statistic that keeps rattling around my head. According to a recent industry survey, something like seventy percent of companies that experienced a ransomware attack ended up paying the ransom. And the average payment? Over two million dollars. Luna: Two million dollars just to get your data back. And that's the average. Some are much higher. Lucas: Right. But here's the thing I find fascinating. The decision to pay isn't just a simple math problem. It's layered with ethics, legal exposure, and the practical reality of getting your business back online. So today I wanted to dig into the business of ransomware negotiations. What actually happens when a company gets that first demand? Who's in the room, and how do they decide whether to pay? Luna: And is paying ever the smart move? Or is it always a slippery slope? Lucas: Exactly. Let's start with a concrete case. A mid-sized logistics company I read about recently—let's call them FreightCore—got hit with a ransomware attack. The attackers encrypted their shipment tracking systems, which essentially brought their operations to a halt. Within hours, they had a demand for three million dollars in cryptocurrency. Luna: Three million. And what was their actual revenue at stake? Because I'm guessing the cost of downtime was probably higher. Lucas: That's the key calculation. FreightCore was moving about eighteen million dollars in goods per day. So every day they were down, they were losing potential revenue, plus contractual penalties with clients who were furious. Suddenly, three million dollars doesn't look so crazy if it means you're back online in 48 hours instead of three weeks. Luna: So in that context, paying almost feels like a business expense. Like a cost of doing business. Lucas: That's exactly how many CFOs frame it. But here's where it gets complicated. Who do you even pay? And how do you know they'll actually give you the decryption keys? That's where professional ransomware negotiators come in. These are often former law enforcement or intelligence folks who specialize in talking to cybercriminals. Luna: So there's a whole industry of people who are basically professional hostage negotiators, but for your data. Lucas: Precisely. And the first thing a negotiator will tell you is that you never just pay the initial demand. You always negotiate. The criminals expect it. In fact, if you pay immediately, they often think they didn't ask for enough. Luna: So there's a whole psychology to it. They're trying to maximize their payout, but they also want to get paid and move on. They don't want to get stuck on one target. Lucas: Right. And good negotiators know how to read that. They'll start by asking for proof of life—a decryption test on a sample file to show they actually have the capability. Then they'll push back on the price, often using arguments like 'the company is small, we can't afford that' or 'our cyber insurance has a cap.' It's a strange dance. Luna: And in the FreightCore case, what happened? Did they end up paying? Lucas: They did. After two days of back and forth, they settled at one point eight million dollars—down from three. The negotiator got them a forty percent discount. And the company was back online within a week. But here's the thing that keeps me up at night. Even after they paid, they discovered the attackers had exfiltrated sensitive client data before encrypting. So they didn't just lose money—they had a data breach on top of the ransomware. Luna: That's the nightmare scenario. You pay, you get your systems back, but the data's already out there. And now you have a disclosure obligation on top of everything. Lucas: And that's where the ethical and legal dimensions really kick in. Because in some cases, paying a ransom might actually be illegal. The Office of Foreign Assets Control—OFAC—has made it clear that paying a ransom to a sanctioned entity can be a violation of US sanctions law. And many ransomware gangs are based in Russia or North Korea, so there's real exposure there. Luna: So you're telling me a company could pay a ransom and then get hit with a fine from the Treasury Department? That seems like adding insult to injury. Lucas: It's happened. There have been enforcement actions and settlements. And that's partly why so many companies now bring in outside counsel and compliance experts before making a payment decision. They want to document everything and make sure they're not stepping on a legal landmine. Luna: And cyber insurance—does it cover ransom payments? Because I remember we did an episode on how premiums are priced after a breach. This feels related. Lucas: It is. Most cyber policies now have a specific sublimit for ransomware payments. But the insurers are getting smarter. They'll often require the company to use their approved negotiators, and they may even have a policy that says they won't cover a payment to a sanctioned entity. So the insurance company becomes another voice in the room, often pushing for a tough stance. Luna: So you've got the negotiator on one side, the insurance company on another, and the company's own leadership trying to weigh the reputational damage of paying vs. the operational damage of not paying. Lucas: Exactly. And that's not even mentioning the public relations angle. Some companies are terrified of being seen as paying criminals. But others argue that the real reputational damage is telling your customers you lost their data and couldn't get it back. There's no easy answer. Luna: Speaking of reputations, I know we've talked about this before, but I think it's worth repeating: the best defense is still a good backup and incident response plan. If you can restore from backups, you don't need to negotiate at all. Lucas: Absolutely. And that's actually a great segue into a quick thought about the show itself. We spend a lot of time on these episodes geeking out over the mechanics of cyber defense, and if you've found this conversation useful, well, honestly, if today was worth a coffee to you, that's the link—buy me a coffee dot com slash fexingo. It's the smallest ask, and it's how we keep this podcast free and without ads. Luna: Yeah, it's a nice way to support the work we do, especially if these deep dives help you think about your own business security. Lucas: Alright, back to the trenches. So we've talked about the decision to pay. But what about the companies that refuse? What happens to them? Luna: I've heard of a few high-profile cases where companies just said no. What's the typical outcome? Lucas: It varies. Some have solid backups and can recover without paying. Others end up spending even more money on forensics, legal fees, and rebuilding systems from scratch. And sometimes, the data is truly lost. There was a case in the healthcare sector where a hospital refused to pay, and they ended up having to divert patients to other facilities for weeks. Luna: So the calculus isn't always clear-cut. Sometimes paying is actually the lesser evil, even if it funds the bad guys. Lucas: That's the uncomfortable truth. And it's why the debate over ransomware payments is so heated. On one hand, paying encourages more attacks. On the other hand, if you're a small business with no backup and your entire customer database is encrypted, the immediate survival of your company might depend on paying. Luna: And that's why the government is stepping in. I saw that the Treasury Department is considering new regulations that would require companies to report ransom payments more quickly, and maybe even require them to get a license before paying if the actor is on the sanctions list. Lucas: Right. And there's also talk of making ransomware payments illegal outright, which would be a huge shift. But law enforcement and security experts warn that a blanket ban could backfire—companies might just not report attacks at all, which would make it even harder to track the criminals. Luna: It's a balancing act between punishing the criminals and not punishing the victims. Lucas: Exactly. And in the meantime, what can a company do? I think the takeaway is that you need to have a ransomware playbook before you ever need it. That means knowing your data, having tested backups, and having a relationship with a negotiator and legal counsel who can jump in quickly. It also means understanding your insurance policy and what it covers. Luna: And maybe most importantly, having a clear policy on whether you'll ever pay. Because if you've already decided that, you can avoid the panic in the moment. Lucas: That's a really good point. Some companies have a blanket no-pay policy. Others have a threshold. But making that decision in advance, with input from your board and your legal team, can save you from making a bad decision under pressure. Luna: So what's the future look like? Are we going to see more regulation, more enforcement, or more creative negotiation tactics? Lucas: I think we're going to see a combination. More regulation is almost certain, but so is the evolution of the ransomware business model. Some gangs are moving toward data exfiltration and extortion without encryption, which makes backups less of a silver bullet. And we're also seeing the rise of 'ransomware as a service,' where the whole operation is outsourced. Luna: So it's like the dark web version of franchising. Lucas: Exactly. And that means the pool of attackers is growing, and the barriers to entry are lower. So the threat isn't going away. The question is whether the business community can adapt faster than the criminals. Luna: And that's the million-dollar question, isn't it? Or in this case, the multimillion-dollar question. Lucas: Ha. I think that's a perfect place to leave it. Thanks for joining us on this deep dive into the murky world of ransomware negotiations. Until next time.