Ransomware payment still seen as ‘way out’ for three-quarters of Australian businesses

McGrathNicol research found that 70% of businesses, said they would be willing to pay a cyber ransom.

McGrathNicol Advisory released the findings of its third annual ransomware survey, revealing that 56% of Australian businesses have suffered a ransomware attack in the past five years: 42% of medium and large businesses have fallen victim to a single attack, while 14% have been targeted multiple times. Of those that did suffer an attack, close to three quarters (73%) chose to pay the ransom demand.

Now in its third year, McGrathNicol Advisory’s Ransomware Survey provides an authoritative barometer of the ransomware threat to Australian businesses. McGrathNicol partnered with YouGov to survey 500 Australian business owners, partners, directors and C-suite leaders across businesses with 50 or more employees.

The five-year ransomware average is down from a high of 69% in 2022 but remains well above the 31% recorded in 2021 when McGrathNicol started tracking these results. The findings suggest that cyber criminals hit a ransomware peak last year and have diversified to other forms of cyber extortion in 2023.

The proportion of business leaders who reported that they made a ransomware payment declined slightly year-on-year, from 79% in 2022 and 83% in 2021, but has remained high despite government pressure and regulatory scrutiny.

Australian organisations are acquiescing quickly: 74% of executives reported paying the ransom within 48 hours while almost two in five (37%) made the payment within 24 hours.

This is consistent with previous years, with 78% of companies surveyed in 2022 reporting that they paid within 48 hours and 74% in 2021.

Overall, the estimated average cyber ransom paid was $1.03 million, on par with $1.01 million in 2022 and $1.07 million in 2021. This figure is still lower than the average amount that business leaders would be willingto pay ($1.32 million).

Despite consistent government advice against doing so, 70% of surveyed businesses (including those yet to experience an attack) said they would be willing to pay a ransom.

A closer look at payment motivations provides further insight. The research found that three quarters of business leaders (74%) cite external risks as the reason for paying a cyber ransom, including to minimise potential harm to stakeholders, reduce brand damage, and to avoid sensitive information being leaked.

Darren Hopkins, Cyber Partner at McGrathNicol Advisory, said:“Businesses are still overwhelmingly paying ransoms, and paying them quickly, to avoid negative backlash from customers, partners and stakeholders. It’s now being factored in as a cost of doing business.”

“The research shows that executives are becoming empathetic and less hard-nosed about reporting these attacks to authorities. But without greater collaboration and knowledge-sharing, our ability to prevent ransomware attacks is undermined. This intelligence can help business leaders make informed decisions rather than rushing into paying an expensive, and potentially illegal, ransom.”