Pay the ransom? Corporate lawyers say meeting some hackers' demands may be worth it

“Law enforcement has to have a policy, and that has to be their policy,” said one consultant.

Conventional wisdom says ransomware victims shouldn’t pay their attackers, but a panel of legal experts suggested Thursday that standing firm might not always be the smartest play in the real world.

FBI officials, corporate bigwigs and public sector security bosses in recent years all have advised their colleagues to keep their wallets closed when ransomware hits. There’s no honor among thieves, the logic goes, and even if you pay hackers to buzz off, who’s to say they will follow through on promises to unlock encrypted data? But there are scenarios in which small and medium-sized businesses should carefully consider their decision, Mark Knepshield and Matthew Todd said during a panel discussion at the Legalweek conference in New York.

“I would say, if it’s a small amount, pay it,” said Knepshield, a senior vice president at insurer McGriff, Seibels and Williams. “It’s likely just be the easiest way out of your situation.”

In a poll surveying Legalweek attendees, 86 percent said they would not pay a ransom if attackers threatened to publish stolen material online within 24 hours. That follows the traditional legal advice, with the FBI encouraging hacked businesses not to pay, in part because meeting extortionists’ demands could help thieves expand their operations.

“Law enforcement has to have a policy, and that has to be their policy,” said Todd, a principal consultant at Full Scope Consulting and a former chief security officer in the financial sector.

However the evolution of ransomware attacks over the past year has forced firms to reconsider, Todd said. Well-resourced criminal organizations have replaced comparatively low-level “spray-and-pay” operations. Those groups leave behind a trail of evidence that insurers, attorneys and corporate security teams can quickly research to understand their chances of recovering stolen information.

“Like with the city of Atlanta, with the source code that was coming in, even if they had paid the ransom, I don’t think the individuals who launched the attack would have had the sophistication to be able to un-do the [encryption] keys,” Todd said. “You need to ponder it carefully.”

Paying small ransoms may also help frustrated security bosses avoid a browbeating from higher-ups who are more concerned with resuming business than examining the forensic evidence in the midst of an attack. Forfeiting $500 to hackers could hasten that process, and give the chief information security officers an out with his or her boss.

“Being cyber resilient just means being able to explain yourself to shareholders when something goes wrong,” said Roberta Sutton, who founded RAS Enterprise Risk Management services after working with insurers. “We got breached all the time [in the past] but we never reported them because [hackers] never walked out with any of the data, at least that we could tell.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure