On Dec, 8, 2022, a ransomware attack on the Metropolitan Opera in New York City crippled the company’s computer systems enterprise-wide, including its website, box office and call center. As is typical with ransomware attacks, there was no warning and the timing during the key holiday season of performances was awful for the company. With employees and customers generally in the dark, the company was urgently faced with a very troublesome and dramatic question: should they resist the hacker’s demands and go forward as best they could in the face of significant and uncertain technical and public relations challenges, or should they quickly capitulate and pay the hackers to release the systems … hopefully? The potential consequences for the Met from the incident were not small. And after weeks of frantic recovery efforts to restore crippled systems, the company was still selling seats at a hugely discounted $50, and still without full email function as late as Dec. 27.
Of course, the Met has plenty of company as a recent victim of ransomware, and it will certainly not be the last to face this dilemma at the worst possible time. While a large percentage of ransomware attacks go unreported, ransomware incidents continued unabated in 2022. According to cybersecurity firm Sophos’s “The State of Ransomware 2022” report, the average reported ransom payment is up to $812,360, and the average total loss per incident $1.4 million, including business impact, security remediation, legal and compliance costs. In most cases, ransomware attacks simply use traditional hacking techniques to exploit security vulnerabilities to access company network systems.
