Economics of Ransomware Attacks

Recently, the development of ransomware strains as well as changes in the marketplace for malware have greatly reduced the entry barrier for attackers to conduct large-scale ransomware attacks. In this paper, we examine how this mode of cyberattack impacts software vendors and consumer behavior. When victims face an added option to mitigate losses via a ransom payment, both the equilibrium market size and the vendor's profit under optimal pricing can actually increase in the ransom demand as well as the risk of residual losses following a ransom payment (which reflect the trustworthiness of the ransomware operator). We further show that for intermediate levels of risk of the vulnerability being successfully exploited, the vendor restricts software adoption by substantially hiking prices. This lies in stark contrast to outcomes in a benchmark case involving traditional malware (non-ransomware) where the vendor will choose to decrease price as security risk increases. Social welfare is higher under ransomware compared to the benchmark in both sufficiently low and high risk settings. However, for intermediate risk, it is better from a social standpoint if consumers do not to have an option to pay ransom. We also show that the expected total ransom paid is non-monotone in the risk of success of the attack, increasing when the risk is moderate in spite of a decreasing ransom-paying population. For ransomware attacks on other vectors (as opposed to patchable vulnerabilities), there can still be incentives to hike price. However, market size and profits instead weakly decrease in the ransom amount, and strategic discontinuous reductions in price due to increased risk are no longer observed. When studying a generalized model that includes both traditional and ransomware attacks, our results remain robust to a wide range of scenarios, including threat landscapes where ransomware has only a small presence.