Asia/Pacific* Organizations Increasingly Willing to Pay During a Widespread Ransomware Attack, IDC Reports

As ransomware continue to top the list of cyberattacks, affected organizations are often faced with the ultimate decision to make, to pay or not to pay the ransom? According to IDC’s latest Survey Spotlight Will Your Organization Pay the Ransomware? Survey Says …, almost half (44%) of the respondents who participated in the IDC Security Services Global Incident Readiness Survey indicated the willingness to pay the ransom in hopes of retrieving affected files, either internally or through insurance payout.

While the list of countries included in the survey is not exhaustive, Asia/Pacific countries Australia and Singapore top the group that is more willing to pay a ransom, with 60% and 49% of organizations in the respective countries indicating they will be paying the ransom during an attack.

Ransomware attacks significantly hinder operations as files are being encrypted, compromising the availability of critical resources required to carry out daily business processes. This is a key factor that forces the hands of victim organizations especially when no incident management or contingency plans are made. The choices are limited, either to rebuild affected parts of the infrastructure, which usually results in prolonged disruptions, or pay the ransom in hopes of receiving the decryption keys to restore files promptly.

APEJ legislations around ransomware payment are fuzzy at best. While most regulators in the region discourage the payment of ransom during an attack, there are no laws particularly restricting the transaction. In a separate study IDC Future Enterprise Resiliency Survey, 49.4% of APEJ organizations that encountered a ransomware incident chose to pay the ransom, 82.4% of those who paid managed to retrieve a working decryption key, meaning almost 20% paid the ransom but got nothing in return.

“Even though a ransom payment may resolve the particular incident at the point in time, the actual benefits to the organization’s security posture is marginal. IDC believes that a structured investment in enhancing the infrastructure’s cyber resiliency and incident management will reap a more tangible benefit as compared to paying a ransom,” says Jeff Xie, Senior Market Analyst, for Trust, Security and Blockchain research at IDC Asia/Pacific.

IDC believes that the rise of cyber insurance products in the APEJ region also contributes to the willingness to pay during a ransomware attack. Since the financial liability of the payment is balanced out by the insurance payout, coupled with the potential resolution of disrupted activities with minimal resources, one can understand why the sentiment to resolve a cyberattack of this nature via the requested payment is preferred over the traditional approach.

IDC’s Asia/Pacific: Future of Trust research embraces the full hierarchy of trust, including risk, security, compliance, privacy, and reaching into the realms of ethics and social responsibility and will be focused on the actions and tools organizations can use and leverage to endow themselves with the tools and processes required to demonstrate trustworthiness. To learn more, contact Simon Piff at spiff@idc.com or click HERE.

For more information on this report, please contact Jeff Xie at jeffxie@idc.com. For media queries, please contact Tessa Rago at trago@idc.com or Alvin Afuang at aafuang@idc.com.

*Note: Asia/Pacific excluding Japan

-Ends-

About IDC

International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications, and consumer technology markets. With more than 1,100 analysts worldwide, IDC offers global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries. IDC’s analysis and insight helps IT professionals, business executives, and the investment community to make fact-based technology decisions and to achieve their key business objectives. Founded in 1964, IDC is a wholly-owned subsidiary of International Data Group (IDG), the world’s leading tech media, data and marketing services company. To learn more about IDC, please visit www.idc.com. Follow IDC on Twitter at @IDC  and LinkedIn. Subscribe to the IDC Blog for industry news and insights: http://bit.ly/IDCBlog_Subscribe.