As with most criminal activity, the damage created by it is much larger than the money made. I couldn't find any US figures, but global estimates claim ransomware-caused damages of 11.5 billion USD in 2019: https://cybersecurityventures.com/ransomware-damage-report-2...

> As with most criminal activity, the damage created by it is much larger than the money made.

That's what makes extortion work. If the cost to avoid damage is on par with the potential damage, few if any victims would actually pay the criminal. The extorted amount being a fraction of the potential damage makes victims more willing to pay.

This was calculated by Cisco & Cybersecurity Ventures, who both directly profit from the fear generated by these figures. I do not trust these figures.

This is marketing for CIO/CISO's to read so they make sure to add in various security features to their BoM for purchase.

Cybersecurity Ventures is not a clickbaity newspaper. They are specialists. Obviously when they publish articles in their domain, it has an advertising purpose but producing shoddy figures would only hurt their brand.

You can't trust everything coming from companies at face value. That doesn't mean you shouldn't trust anything.

I'm guessing the damage numbers are higher because of a number of high-impact city-focused attacks. I live in Baltimore, where all of the city's systems were shut down for a few months over a ransomware attack asking for <100k. A similar attack occurred last year in Atlanta; wikipedia quotes a demand of 50k & Atlanta estimated around 10M in contractors for recovery.

https://en.wikipedia.org/wiki/2018_Atlanta_cyberattack https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_atta...

Long-tail damage to governments and hospitals is definitely part of it - there's very little upper bound on how much ransomware can cost if you botch the response badly enough. And given how much ransomware simply doesn't decrypt if you pay, there's no reason the ransom prices should have any real correlation to the damage inflicted.

The other part of it appears to be some slightly funny calculations. If ransomware shuts down Target's online store for a day, Target might compute the loss based on 24 hours of no revenue, but purchases that go to Amazon, or to Target a day later, shouldn't be added into total "damage". The dollar value being computed there is something more like disruption.

Hm, that's an interesting calculation. I'm glad you added it here, it's a useful reference point, but it does look like some serious sleight of hand was done to produce it.

The report is from 2017, and relies on a 300% increase in the rate of ransomware to get that 2019 cost. That sounds high, but apparently the 2016 rate did triple in that much time (although the WannaCry spike drove a bunch of that).

On the other hand, it appears to be assuming 300% growth in attacks with a a constant rate of victimization. This doesn't make much sense alongside stats like "In 2016, an average of 40 percent of spam emails contained malware links to ransomware, an increase of 6,000 percent over 2015, when less than one percent contained ransomware." That's a qualitative change from "not a threat" to "threat", and presumably 40% -> 80% would not double attack success rates.

Further, the damage stat attempts to include subjective costs like employee training and reputational harm, as well as a naive calculation of revenue costs which assumes no revenue lost to donwtime will be recovered post-attack. That's a fairly reasonable corporate estimate, but summing it across all victims this way isn't valid at all. Only a fraction of that balance-sheet loss is actual GDP-shrinking damage, while the rest becomes either loss to competitors or value-creating OpEx like security and training investment.

Hilariously, one of the linked Cybersecurity Ventures writeups also claims[1] that "cybercrime will cost the world in excess of $6 trillion annually by 2021, making it more profitable than the global trade of all major illegal drugs combined". It's amazing what kind of numbers you can invent when you compare the societal cost of one crime to the net profit of another. As much as I love William Gibson, I don't think the cartels will be swapping their chemists for programmers within the next two years.

[1] https://blogs.cisco.com/financialservices/ransomware-lessons...

The attention seems to be due to two factors: the high-profile cases that hit large organizations like school districts, local government or hospitals (which are not affected by common scams), and the relative novelty of using cryptocurrency for paying the ransom (though not predominantly, according to this survey; I would guess that using cryptocurrency reduces the yield from the individual users that are the common victims.)

Ransomware can be hard to trace, which keeps risk low, and that means criminals can afford to ask for less money. It's also a benefit to keep the ransoms small enough that people will pony up instead of getting the FBI involved.

For now it may be just noise, but the ransoms are quickly getting bigger and bigger. Last month I facilitated the payment of 3 BTC to decrypt the files.

I imagine these sort of attacks are more like spear phishing, in that they look for high value targets. No one is paying $25k for the family laptop files, but a medium sized business,perhaps digital in nature, would be quick it pay that price to fix the problem.

Now that there is insurance for ransom ware, The insurers are usually paying the criminals, which will only lead to more attacks.