On June 8, 2021, Kevin Szczepanski, co-leader of the Cybersecurity Team, was a panelist for the USLAW webinar “Ransomware: You Don’t Always Have to Pay.” One question the Cybersecurity Team has been asked several times since the webinar is, “If my business is forced to pay a ransom, will the threat actor actually provide a decryption tool?” In other words, how do you know that you will get your data back after paying a ransom?
To answer this question, we spoke with an industry expert, the director of incident response at a leading ransomware forensic firm. As our expert tells us, there are two questions to consider here. The first is: How often does a threat actor provide a decryption tool? The second question is: How much of the business’s data actually “comes back” after employing the tool?
The answers to these questions may surprise you. Actual default—you pay and get nothing in return—is rare; it happens only about 1.5 percent of the time. So far, so good. But the second, more important question is: How well do the threat actors’ decryption tools work? The answer is that it depends on the ransomware used. Decryption tools supplied for some ransomware (Clop, Conti, Darkside, and REvil) have recovery rates of 95 to 99 percent. But tools supplied for other ransomware (Lockbit, Mamba, Phobos, and PYSA) have recovery rates in the 80 to 90 percent range.
What does this tell us? First, the ability to recover data depends in part on the type of ransomware the threat actor uses. Second, even a “successful” recovery could net a loss of up to 20 percent of an organization’s data.
In light of this, we are encouraging our clients to invest in prudent “cyber hygiene,” or a series of physical, electronic, and “human” safeguards designed to limit the risk of loss resulting from a cyber attack.
If you have questions about cyber hygiene, the content of this blog post, or would like the “Ransomware: You Don’t Always Have to Pay” webinar materials, please contact Kevin Szczepanski or Nick DiCesare, co-team leaders of the Cybersecurity Team, at kszczepanski@barlcaydamon.com and ndicesare@barclaydamon.com, respectively, or another member of the firm’s Cybersecurity Team.