[herenorthere]

I work with a cryto exchange, and fwiw, can tell you that most businesses would agree with you. They pay the ransom. And they use common exchanges like Coinbase, Binance, and Bittrex to do so.

The only way not-paying the ransom is beneficial (aside from having proper backup systems in place obviously) is if there was a large public sentiment shift promoting NOT paying ransoms. If society at large came together and decided the majority of entities are NOT going to pay, then ransomware viruses would be less profitable and thus not as favorable projects for hackers/scammers.

But that would take a lot of effort, organization, and favorable circumstances to have everyone do that simultaneously going forward. And there would be casualties at the beginning before the public sentiment cemented itself in the collective conscious.

But yeah, the only way ransomware will stop is if it stops becoming profitable: which means companies either need to have proper OpSec and backups (so they have no need of paying), or collectively agree that no one will pay ransomware attacks.

Seems like a pipe dream that we'd ever get to that point though. So I imagine companies will continue to fork over the ransoms.

Edit: this got me thinking, say for example, the US government outlawed paying the ransom to hackers. And they could somehow enforce this law effectively. Wouldn't that pretty much stop ransomware attacks in the US? or where ever a law like that could be effectively enforced?

[jrochkind1]

I think society has come together and decided we're all going to pretend we're not paying and talk publicly about how nobody should ever pay, while mostly everyone is paying.

Society also seems to have come together and decided we'd rather save money than spend it on effective backups and security.