Ransomware can present an organization with an impossible choice, between losing access to, or control over, the organization’s most sensitive data or funding an ever-growing criminal behemoth that has threatened and continues to threaten hospitals, schools, and critical infrastructure, not to mention private industry.
Yet often, an organization’s options to avoid payment are limited, and attackers utilize tactics designed to create maximum pressure to ensure that payment is made. Aside from the business and ethical issues that arise when assessing whether to make a ransomware payment, legal considerations abound, and can increase both the complexity of decision making and of risk surrounding such a payment.
