Ransomware attacks are a growing nightmare for businesses worldwide, and a shocking investigation by ProPublica has revealed a troubling trend in how some companies handle these crises. Instead of using cutting-edge technology to recover encrypted data, many ransomware recovery firms, like Proven Data and MonsterCloud, are resorting to a surprising tactic: paying the hackers. This approach raises serious ethical and security questions, as it fuels a vicious cycle of cybercrime while victims are charged hefty fees for what’s essentially a ransom payout.According to Coveware, a cybersecurity firm specializing in ransomware, the average ransom demand skyrocketed by 89% in Q1 2019, jumping from $6,733 in Q4 2018 to $12,762. This surge reflects the increasing sophistication of ransomware strains like Ryuk, Bitpaymer, and Iencrypt, which target large enterprises with devastating precision. These attacks don’t just lock up critical data; they disrupt operations for days—Coveware reports the average downtime rose from 6.2 days in Q4 2018 to 7.3 days in Q1 2019. For businesses, the pressure to resolve these attacks quickly often outweighs concerns about long-term consequences.ProPublica’s investigation uncovered that companies like Proven Data, which promises victims “state-of-the-art technology” to recover data, often rely on paying hackers for decryption tools. Former clients and internal company emails, along with an FBI affidavit, confirm that Proven Data negotiates with cybercriminals to secure decryption keys, then charges clients a premium for their services. Similarly, Florida-based MonsterCloud claims to use proprietary recovery methods but frequently pays ransoms—sometimes without informing clients, including local law enforcement agencies. Both firms also offer additional services, like patching security vulnerabilities, but their reliance on pseudonyms for employees raises further questions about transparency.The ransomware epidemic shows no signs of slowing. Despite high-profile efforts, like the U.S. indictment of two Iranian hackers behind the SamSam ransomware, attacks have surged past 2018 levels. Why? Because ransomware is wildly profitable. Hackers can launch attacks, negotiate quick payouts through intermediaries like MonsterCloud, and move on to the next target. Coveware’s CEO, Bill Siegel, notes that many hackers are “relatively normal people” with technical skills but limited legal economic opportunities, often operating in regions beyond Western law enforcement’s reach. Coveware openly admits to negotiating with hackers, arguing it’s often the fastest way to restore data. However, this practice raises alarms about inadvertently funding criminal networks or even terrorism.The bigger issue is the lack of accountability. Recovery firms charge victims thousands on top of the ransom, profiting from a crisis while perpetuating a system that emboldens hackers. Meanwhile, researchers are working on free decryption tools for strains like WannaCry, but newer ransomware variants are increasingly complex, making recovery without payment harder. As ransomware evolves, businesses are caught in a bind: pay up and risk fueling crime, or resist and face prolonged disruption. Until stronger global cybersecurity measures are in place, this shadowy industry will continue to thrive.
