Ransomware attacks are a growing nightmare for businesses worldwide, and a shocking investigation by ProPublica has revealed a troubling trend in how some companies handle these crises. Instead of using cutting-edge technology to recover encrypted data, many ransomware recovery firms, like Proven Data and MonsterCloud, are resorting to a surprising tactic: paying the hackers. This approach raises serious ethical and security questions, as it fuels a vicious cycle of cybercrime while victims are charged hefty fees for whatâs essentially a ransom payout.According to Coveware, a cybersecurity firm specializing in ransomware, the average ransom demand skyrocketed by 89% in Q1 2019, jumping from $6,733 in Q4 2018 to $12,762. This surge reflects the increasing sophistication of ransomware strains like Ryuk, Bitpaymer, and Iencrypt, which target large enterprises with devastating precision. These attacks donât just lock up critical data; they disrupt operations for daysâCoveware reports the average downtime rose from 6.2 days in Q4 2018 to 7.3 days in Q1 2019. For businesses, the pressure to resolve these attacks quickly often outweighs concerns about long-term consequences.ProPublicaâs investigation uncovered that companies like Proven Data, which promises victims âstate-of-the-art technologyâ to recover data, often rely on paying hackers for decryption tools. Former clients and internal company emails, along with an FBI affidavit, confirm that Proven Data negotiates with cybercriminals to secure decryption keys, then charges clients a premium for their services. Similarly, Florida-based MonsterCloud claims to use proprietary recovery methods but frequently pays ransomsâsometimes without informing clients, including local law enforcement agencies. Both firms also offer additional services, like patching security vulnerabilities, but their reliance on pseudonyms for employees raises further questions about transparency.The ransomware epidemic shows no signs of slowing. Despite high-profile efforts, like the U.S. indictment of two Iranian hackers behind the SamSam ransomware, attacks have surged past 2018 levels. Why? Because ransomware is wildly profitable. Hackers can launch attacks, negotiate quick payouts through intermediaries like MonsterCloud, and move on to the next target. Covewareâs CEO, Bill Siegel, notes that many hackers are ârelatively normal peopleâ with technical skills but limited legal economic opportunities, often operating in regions beyond Western law enforcementâs reach. Coveware openly admits to negotiating with hackers, arguing itâs often the fastest way to restore data. However, this practice raises alarms about inadvertently funding criminal networks or even terrorism.The bigger issue is the lack of accountability. Recovery firms charge victims thousands on top of the ransom, profiting from a crisis while perpetuating a system that emboldens hackers. Meanwhile, researchers are working on free decryption tools for strains like WannaCry, but newer ransomware variants are increasingly complex, making recovery without payment harder. As ransomware evolves, businesses are caught in a bind: pay up and risk fueling crime, or resist and face prolonged disruption. Until stronger global cybersecurity measures are in place, this shadowy industry will continue to thrive.
