Ransomware Negotiators Say Payment Demands Doubled This Year
Incident responders report larger opening demands and faster deadlines, pushing more firms to rehearse their response in advance.
Ransomware incident responders report that opening demands have roughly doubled over the past year, and deadlines have grown shorter. The change is pushing more organisations to rehearse their response in advance rather than improvising during an attack.
What negotiators are seeing
Attackers are combining encryption with data theft, threatening to publish stolen information if victims do not pay. Many groups now research their targets carefully, setting demands based on revenue, cyber insurance coverage and perceived ability to pay.
“They often know more about the victim's finances than the victim's incident response team does.”
Decisions that should be made before an attack
The most damaging delays happen when executives meet for the first time to debate questions that could have been settled months earlier.
- Under what circumstances, if any, will the organisation consider paying?
- Who has authority to make that decision, and who must be consulted?
- When are regulators, insurers and law enforcement notified?
- How will customers and employees be informed?
Recovery is the real defence
Organisations that recover without paying almost always share one trait: they can restore critical systems from backups that attackers could not reach. Immutable, offline and regularly tested backups remain the single most effective response to ransomware.
A board-level issue
Ransomware is no longer just a technical problem. It is a business continuity, legal and reputational risk that demands executive preparation. Rehearsing the response is far cheaper than discovering the gaps during a live incident.