In this talk, the speaker argues that the rise of ransomware is driven by the fact that victims continue to pay extortion demands, which financially rewards and incentivizes cybercriminals. The only sustainable way to break this cycle is for organizations to refuse to pay, coupled with strong cybersecurity preparedness. The speaker cites the high‑profile case of CD Projekt Red, which refused to pay ransomware attackers even after they threatened to sell the company’s game source code; the code was later reportedly sold on the dark web, illustrating the risks and the ethical stance of refusing payment. Recent data from ransomware recovery firm Coveware shows a 34% drop in average ransom demands and a shift where about 60% of victims now decline to pay, down from roughly 75% previously. Paying ransom also makes organizations attractive repeat targets, as attackers maintain lists of those who have paid and re‑attack them. The speaker concludes that the path forward is clear: improve cyber defenses, adopt a no‑pay policy, and thereby collectively diminish ransomware incentives.
Chapters
Ransomware is on the rise, and one of the biggest reasons is because cybercriminals are being rewarded. Those who are impacted have been paying the ransoms, thereby funding and encouraging them to expand and target others. The greed principle mandates that ransomware will only increase under these circumstances. The only way we get out of this this vicious cycle is to deny the extortion payments. Many organizations work very hard so that they're properly prepared in the event that they are impacted by ransomware. And that makes it easy to simply say no to the criminals. Unfortunately, many organizations, including government and public agencies, are ill-prepared and subsequently go down the path of paying the criminals. Removing the likelihood of payment is the only long-lasting strategy that will work. It is one of only three ways to undermine cyber risks, right? Remove the objective. Without the chances of being paid, cyber criminals who are largely motivated by personal financial gain will seek other types of gambits other than ransomware. Cybercriminals know this, and they've been working and adapting to turn up the pressure on the victims to motivate them into payment. The latest is to threaten public exposure of the data or even selling it on the dark web so that the victim's data is out there to, to somebody who's unknown. One such recent victim, CD Projekt Red, who is a notable game developer of such titles as Cyberpunk 2077 and The Witcher series, suffered a ransomware attack recently, and they refused to pay. The criminals, well, they weren't very happy, and they threatened to release the company's game source code, right? This is the, the crown jewels typically of a gaming company, their source code. To the highest bidder. Now, the company still refused, and there are reports that the code was sold on the dark web to an unknown customer. Such events are painful, but an important lesson for all of us. It does showcase the ethical position that this company took, and I absolutely applaud them. And in doing so, it forced the attackers, well, outside side of their plan. It created more difficulties and complexities for them, and things like that can result in mistakes, and authorities can definitely take advantage of those sometimes. Again, we don't want to play by the attacker's rules. The threat always has a plan. The attacker always has a plan. You don't want to follow their plan. Because in every case you lose. So disrupt it if you can. In such a position, um, to deny the extortionist their prize, well, that has to happen much more often. And the good news is that some data is pointing in that direction. Coveware, a ransomware recovery company, reported that the average ransom payment has dropped 34% in single quarter as criminals are now lowering their demands in hopes of more compliant victims. Kovar also reported that about 60% of the victims declined to pay the ransom, whereas just one quarter, uh, prior, almost 75% did pay the ransom. The right path forward to crush ransomware attacks is absolutely clear. Better cybersecurity preparedness, and a willingness not to pay the extortionists regardless of their actions or their threats. That is how we collectively defeat ransomware. Now, many organizations are finally coming to that realization, and they're leaving the remainder to be highly sought-after targets by criminals, right? Those who don't go down this path Those who do pay those ransom, well, they get recognized. In fact, the criminals maintain lists of organizations that have paid. In fact, they circle back around and they reattack them. Why? Because they know they're willing victims. So in the end, it doesn't really pay anyway. Now let's make sure your organization is not one of those easy victims. By establishing a well-thought-out cybersecurity capability. We do not want these easy victims because they perpetuate the problem for everyone.
