Ransomware evolving

 MedCity News reports on the evolving cat and mouse game between ransomware criminals and health care organizations.

The Changing Landscape of Ransomware: Why Healthcare Organizations Are Paying Less
Threat actors continue to refine their strategies, and the financial incentives for cybercrime persist. However, the combination of stronger defenses, regulatory pressure, and industry collaboration is starting to shift the balance in favor of defenders.  By Chris Henderson  

"Ransomware has long been a persistent and costly threat to healthcare organizations, which hold vast amounts of sensitive patient data and operate under critical, time-sensitive conditions. The disruption caused by these attacks can have life-threatening consequences, delaying essential treatments and compromising patient safety. Historically, the urgency of restoring services quickly and avoiding disruptions compelled many victims to pay ransoms. But that’s starting to change. As healthcare organizations boost their cybersecurity investments — with IT budget allocations rising from 10% in 2020 to 14%(Opens in a new window) in 2024 — fewer victims are paying ransoms, thanks to stronger defenses and heightened regulatory scrutiny.

Overall, ransomware payments in the U.S. dropped 35%(Opens in a new window) in 2024, totaling $813 million, down from $1.25 billion in 2023. The median ransom payment also fell 45%(Opens in a new window) in Q4 2024 to $110,890, as payments remain largely a last-resort option for those without alternatives to recover critical data. Healthcare Information and Management Systems Society (HIMSS) researchers also noted a decline in the number of ransomware victims reporting(Opens in a new window) ransom payments

...

"One of the most effective deterrents to paying ransomware demands is having a robust backup and disaster recovery strategy. In the past, many healthcare organizations lacked adequate redundancy, leaving them with few options beyond paying attackers to restore access to their systems. However, the industry has made significant progress by investing in modern backup solutions, including immutable storage, air-gapped backups, and real-time data replication. Restoration from backups is rarely instantaneous, though. This makes having documented and practiced continuity plans critical for maintaining operations without key technology.

These measures significantly reduce the leverage attackers hold. With reliable, easily restorable backups, and rehearsed continuity plans, healthcare providers can refuse ransom demands and recover systems independently. Additionally, security tools that improve organizations security posture, like endpoint detection and response (EDR), managed detection and response (MDR), and zero-trust architectures, are making it harder for ransomware to gain a foothold in the first place.

...

"At the same time, government regulations are increasing the risks associated with making payments. In the U.S., the Department of the Treasury’s Office of Foreign Assets Control (OFAC) has issued warnings that organizations paying ransoms to groups linked to sanctioned entities could face legal consequences. Given that many ransomware groups have ties to sanctioned regions, healthcare providers face significant liability if they choose to pay.

...

"As direct ransomware payments decline, cybercriminals are adapting their tactics. Many groups have shifted away from traditional encryption only attacks toward data exfiltration and extortion. Instead of only locking organizations out of their systems, attackers steal sensitive patient records, financial data, and proprietary information, threatening to release it publicly if their demands aren’t met.

This strategy allows cybercriminals to bypass traditional defenses such as backups and file encryption protection, which are ineffective against data leaks. While organizations may recover their infrastructure without paying, the risk of exposing protected health information (PHI) creates a new pressure point for victims."

Kidnapping and ransom in Nigeria

 Paying ransom is a repugnant transaction that looks different ex ante and ex post.  In Nigeria, where kidnapping is rampant, the government's view is increasingly that ransom payments should be prohibited, to make kidnapping unprofitable.  But after family members have been kidnapped, families are reluctant to let them be murdered, and are consequently eager to negotiate a ransom.

The WSJ has the story

A Kidnapping Negotiator Gets His Biggest Test: Saving His Own Wife. Abdullahi Tumburkai volunteers to help bargain with kidnappers in what has become a crisis of abductions in Nigeria.  By Joe Parkinson 

"Mr. Tumburkai estimates he has helped free more than 80 people across Nigeria’s northwest over the past year, in what has become one of the world’s worst kidnapping crises. Kidnapping for ransom has become a brutally profitable business across the country by heavily armed criminal gangs exploiting the government’s weak security presence. Gangs abducted an estimated tens of thousands of Nigerians in 2021, including more than 1,200 children seized from their schools.

...

"If they don’t haggle a ransom the victims can afford, hostages could be killed. If they succeed, these brokers make themselves a target among those who oppose any negotiations with kidnappers. The work embodies a moral argument that divides governments across the world: Should you pay to secure the return of hostages?

"Nigeria’s government and many community leaders say freelancers like Mr. Tumburkai are making the problem worse by creating a pathway for payments that finance terrorism and encouraging more kidnappings.

"Garba Shehu, Nigeria’s presidential spokesman, said that negotiating with kidnappers was “totally unacceptable” and that the government frowns at ransom payments. “It’s the responsibility of the police to advise persons whose relatives were kidnapped on what to do,” he said.

...

"On Wednesday, Nigeria’s attorney general said the groups responsible for the kidnappings would be formally listed as terrorists, and as a result anyone negotiating with kidnappers could be charged with financing terror groups."

Reputation among thieves: ransomware and kidnapping

Like everyone else, I occasionally get notifications of data breaches from organizations with which I have digital relations.  Often the breach involved a third party.  Sometimes the breach involves the theft of data accompanied by a demand of ransom--i.e. the victim is invited to pay the cybercriminal, who then promises to destroy the data instead of selling it on the dark web or otherwise using it.

This bears some resemblance to the kidnapping business, and its high-seas version, piracy.

Here's part of an email I recently received informing me of such a breach, and subsequent payment of ransom.

"I’m writing to inform you that Blackbaud, the company that hosts [xxx’s] relationship management system, suffered a security incident in May. Blackbaud is the world’s largest provider of fundraising technology for non-profits and educational institutions, and many organizations have been impacted by this incident.

...

"We were also informed by Blackbaud that in order to protect data and mitigate potential identity theft, it met the cybercriminal’s ransomware demand. Blackbaud has advised us that it received assurances from the cybercriminal and third-party experts that the data was destroyed. Blackbaud has been monitoring the web in an effort to verify the data accessed by the cybercriminal has not been misused. "

************

Why should "assurances from the cybercriminal" be reassuring? (and for how long?).  And what are the roles played by "third-party experts"?

My guess is that, as in the kidnapping biz, intermediaries have emerged to conduct the negotiations, get some sort of assurances, and make it possible for criminal organizations to maintain reputations for honor among thieves.

It is of course possible to regard ransom paying as a repugnant transaction that facilitates ransomware, kidnapping, etc.  In fact the U.S. for some time made it a crime to pay ransom to kidnappers, but relaxed that view over time, as kidnapping became a bigger international business, and there was often a considerable desire (sometimes covered by insurance) to pay ransom when it seemed the best way to recover the kidnapped person alive.

Here are some related posts which touch on that story:

Monday, June 24, 2019  Kidnapping insurance

Tuesday, September 13, 2016 Ransom as a (not so) repugnant transaction

Saturday, June 27, 2015 Ransom as a repugnant transaction--the U.S. relaxes its position

Monday, August 9, 2010 Brokers for pirate ransom

Saturday, December 5, 2009 Market for kidnapping

Friday, February 13, 2009 Pirate ransom: counterparty risk in the endgame

Sunday, November 30, 2008 Pirate ransom: counterparty risk

Ransom as a (not so) repugnant transaction

The United States is revising some policies regarding dealing with Americans held hostage, e.g. in the middle east.  The NY Times has the story:
In a Shift, U.S. Includes Families in Hostage Rescue Efforts
By ADAM GOLDMANSEPT. 11, 2016

It includes the following observation:
"And while the administration has continued its policy of not paying ransoms, it has now pledged not to criminally charge families if they decide to pay one."