I'm beginning to think we should ban ransom payments to criminals or at least disallow insurance to cover them. I know that sounds extreme, but hear me out. It's very worth exploring at this time, as the scope of the problem is exponentially growing in the wake of COVID-19. According to a new report by Emisoft, ransomware demand costs could reach new highs this year exceeding $1.4 billion in the United States in 2020.

Ransomware Has Evolved and the Stakes Are Getting Higher

Ransomware attacks have changed over the course of their notoriety. While some might think that because the typical target is no longer individuals, but rather larger organizations, that they are personally safe, the truth is actually that the risks have only gone up for both individuals and organizations. Whereas before, an individual would know if their data had been taken ransom, it is more likely now that data they've entrusted to a third party (often entrusted to yet another third party), is being taken, leaked or sold, and the individual is not made aware until the larger organization notifies them, always long after the fact, usually only announcing incidents when obligated to, meaning you are just as at risk, without the knowledge or agency to protect yourself.

We Need To Starve the Cyber Crime Industry

The ransomware problem, however, is not likely something that can be challenged by any individual. It will take a collective effort, with the entire ecosystem cooperating to starve the ransomware "industry" and the cybercriminals behind it so that it is no longer a profitable scam. It is often seemingly the path of least resistance to pay ransoms, but this practice actually perpetuates the problem. A voluntary embargo of ransom payments is unlikely, so it will fall to social and political pressure to prevent people from negotiating with cybercriminals. We could make it illegal to pay a ransomware demand, or to otherwise discourage it. Or, we could look at the effect cyber insurance (and the fact that it covers ransomware payments) has on ransomware attacks. If regulation disallowed insurance from covering these payments to criminals, and instead refused to cover entities that did not engage in the minimal cybersecurity measures needed to protect private data, it's possible we could snuff out ransomware as a practice.