Examining ransomware payment decision-making among small- and medium-sized enterprises

European Journal of Criminology, vol. 22, pp. 625–645

Abstract

Ransomware is currently one of the most prominent cyberthreats for organizations. Small- and medium-sized enterprises are particularly vulnerable to ransomware victimization and more inclined toward paying the ransom. However, while a few studies have been conducted on victimization of ransomware, little is known about how small- and medium-sized enterprises respond to victimization and what factors contribute to the decision to pay the ransom. This study uses a survey with a vignette experiment conducted among 445 owners and managers of Dutch small- and medium-sized enterprises to gain more insight into the factors that are related to the decision to pay the ransom in the event of ransomware victimization. Findings show that the likelihood that the ransom is paid is low. While the affordability of the ransom demand seems unrelated to the likelihood of paying, being advised by a cybersecurity company to pay the ransom and not having a back-up significantly increases the likelihood of the ransom being paid. The findings provide insight into factors that make ransomware victims vulnerable to extortion. Furthermore, implications for how ransomware attacks can be mitigated are discussed.

Authors 4

1. Sifra R. Matthijsse corresponding

   The Hague University of Applied Sciences

   Affiliation as printed

   The Hague University of Applied Sciences, the Netherlands

2. Asier Moneva

   Netherlands Institute for the Study of Crime and Law Enforcement · The Hague University of Applied Sciences

   Affiliation as printed

   The Hague University of Applied Sciences, the Netherlands; Netherlands Institute for the Study of Crime and Law Enforcement (NSCR), the Netherlands

   The Hague University of Applied Sciences, the Netherlands

3. M. Susanne van ‘t Hoff-de Goede

   The Hague University of Applied Sciences

   Affiliation as printed

   The Hague University of Applied Sciences, the Netherlands

4. Rutger Leukfeldt Aachen

   Leiden University · Netherlands Institute for the Study of Crime and Law Enforcement · The Hague University of Applied Sciences

   Affiliation as printed

   The Hague University of Applied Sciences, the Netherlands; Netherlands Institute for the Study of Crime and Law Enforcement, the Netherlands (NSCR), Leiden University, the Netherlands

   The Hague University of Applied Sciences, the Netherlands