Reporting ransomware victimization: explaining citizens’ willingness to report to the police and other organizations

Computers in Human Behavior Reports, vol. 23, pp. 101184

Abstract

Although ransomware is considered one of the biggest online threats today, little is known about citizens’ reporting behavior and their willingness to report such incidents. Insight into victimization is further complicated by the fact that attacks are reported to different organizations. Therefore, this study examines the association between the willingness to report ransomware victimization to the police and other organizations, alongside possible explanatory factors, such as offense characteristics, victim characteristics and motivations for (not) reporting to the police. Using a vignette experiment ( n = 3,404), respondents were shown a hypothetical ransomware attack varying in ransom amount, threat of data leakage, backup availability, and external advice to pay. Results show that a significant number of respondents would report the attack, highlighting a discrepancy with actual reporting rates in the Netherlands. The findings show that a higher ransom amount, the threat of leaking confidential data, and advice to pay the ransom significantly increase the willingness to report, suggesting that perceived severity and external support influence the intention to report. Furthermore, the study shows that women, older individuals, individuals with higher education, individuals with an average income and individuals living with parents or guardians are more likely to report. Moreover, it reveals that perceived vulnerability is a strong predictor of reporting behavior and that a strong sense of justice and community responsibility are significant drivers for reporting ransomware to the police. However, doubts about police effectiveness, and a preference for alternative solutions prevent Dutch citizens from reporting ransomware to the police.

Authors 4

1. Tijmen L. Fuchs corresponding

   The Hague University of Applied Sciences

   Affiliation as printed

   Centre of Expertise Cyber Security, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, 2521 EN, The Hague, The Netherlands

2. Sifra R. Matthijsse Aachen

   Leiden University · The Hague University of Applied Sciences

   Affiliation as printed

   Centre of Expertise Cyber Security, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, 2521 EN, The Hague, The Netherlands

   Leiden University, Rapenburg 70, 2311 EZ, Leiden, The Netherlands

3. M. Susanne van ‘t Hoff-de Goede

   Netherlands Institute for the Study of Crime and Law Enforcement · The Hague University of Applied Sciences

   Affiliation as printed

   Centre of Expertise Cyber Security, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, 2521 EN, The Hague, The Netherlands

   Netherlands Institute for the Study of Crime and Law Enforcement, De Boelelaan 1077, 1081 HV, Amsterdam, The Netherlands

4. Rutger Leukfeldt Aachen

   Leiden University · Netherlands Institute for the Study of Crime and Law Enforcement · The Hague University of Applied Sciences

   Affiliation as printed

   Centre of Expertise Cyber Security, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, 2521 EN, The Hague, The Netherlands

   Leiden University, Rapenburg 70, 2311 EZ, Leiden, The Netherlands

   Netherlands Institute for the Study of Crime and Law Enforcement, De Boelelaan 1077, 1081 HV, Amsterdam, The Netherlands