Ransomware: to pay or not to pay
-
@DustinB3403 said:
@scottalanmiller a profitable business never "wants" to go out of business.
That's like saying you want to cut off your left arm because you're tired of the occasional itch that it has.
Sure they do, if the profit isn't enough to justify the investment of effort.
-
Let's take this to the personal level. Saying that giving up a business is never worth it is like saying that giving up a job is never worth it because "it makes money". Even that minimum wage job that sucks and costs you a fortune to commute to... it still makes "a little" money, so you can't give it up.
Of course you can. And by doing so maybe you will just enjoy your free time or maybe you will use your effort to do something more profitable.
All business comes at a cost of other opportunities.
-
Let's give an example....
UltraTech makes $100m per year in revenue. They get hit with ransomware. They are a publicly traded company. How much should they pay in ransom?
-
Of course I left out profit, the only number that really matters. Revenue means literally nothing. The profit might be $10K per year. $99,990,000 is what the operational costs are. Every year they fear that they are going to not make profit and might lose money. It is a huge risk for tiny profits.
Now they are being held for ransom. How much would you be willing to pay in ransom if you were the person who has to answer to the share holders?
-
Remember when a company goes out of business, yes the business ceases, but the people trying to make money off of it continue to exist. They can start a new company or just get normal jobs or they can retire. They have lots of options. Any business venture has to be more fun or more profitable or somehow more valuable than something else that they would be doing.
If you consider there to be unlimited value in paying ransomware, you would also see unlimited value in buying said business. But that's not how businesses are evaluated.
That's actually a good way to think of it.... if you had to buy the same business fresh, how much would an investor be willing to pay? You would never pay that same amount in ransomware because of the additional risks involved (they might not turn over your data, they might have sold it, you are now a target, etc.)
Because that is basically what is happening with ransomware - you are buying the business again.
