How cyber insurance influences the ransomware payment decision: theory and evidence

Abstract

In this paper we analyse how cyber-insurance influences the cost-benefit decision making process of a ransomware victim. Specifically, we ask whether organizations with cyber-insurance are more likely to pay a ransom than non-insureds. We propose a game-theoretic framework with which to categorize and distinguish different channels through which insurance may influence victim decision making. This allows us to identify ways in which insurance may incentivize or disincentivize payment of the ransom. Our framework is informed by data from semi-structured interviews with 65 professionals with expertise in cyber-insurance, cybersecurity and/or ransomware, as well as data from the UK Cyber Security Breaches Survey. We find that perceptions are very divided on whether victims with insurance are more (or less) likely to pay a ransom. Our model can reconcile these views once we take into account context specifics, such as the severity of the attack as measured by business interruption and restoration and/or the exfiltration of sensitive data.

Ransomware Economics: A Two-Step Approach To Model Ransom Paid

“…Previous research already addressed that insurance does not necessarily increase the probability of ransom payments [7] as was confirmed by our results. Nevertheless, having insurance Likewise, the yearly revenue of a company did not influence the payment decision, but did influence the ransom paid.…”

“…A significant subset of victims consists of those who refuse to pay the ransom, as emphasized by [7], [8], [11]. For these individuals, the WTP is effectively zero.…”

“…Cryptoransomware, ransomware for short, is a type of malware that encrypts files, allows victims to regain access upon paying a ransom to the attackers. The surge in ransomware attacks can be attributed to its profitability [7], [11]. Furthermore, [21] highlights that criminals are incentivized to target victims who highly value their data, leading to increased social welfare costs.…”

Double-sided Information Asymmetry in Double Extortion Ransomware

“…We remark that our paper adds to a growing literature using game theory to analyse the ransomware decision process [4,5,9,13]. Prior game-theoretical studies have focused on the interaction of ransomware and victim's decision to invest in security measures like backups or insurance [2,32,36,38].…”

“…The victim then chooses whether to pay the ransom or not. To simplify the analysis we assume an ultimatum bargaining game in 4 The attacker could choose any ransom above 0 for any combination of both own type and signal. So, suppose, more generally, we denote by R S DE , R which there is no opportunity for negotiation.…”