Q+A: The $711,000 cost many businesses are still willing to pay

Ransomware attacks are still a major threat to Australian businesses of all sizes. But the tactics involved are changing, and at the same time, attitudes towards reporting and paying ransoms are evolving too.

Darren Hopkins - Head of Cyber at McGrathNicol - and Brendan Payne - Cyber Partner at McGrathNicol - talk to Sean Aylmer about their latest report on ransomware, including some good news about average payments to attackers.

McGrathNicol is a supporter of Fear & Greed.

Join our free daily newsletter here.

Find out more: https://fearandgreed.com.au/

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:06):
Welcome to Fearing Greed Q and A where we ask
and answer questions about business, investing, economics, politics and more.
I'm Sean Aylmer. Ransomware attacks are still a major threat
to Australian businesses of all sizes, but the tactics involved
are changing and at the same time attitudes towards reporting
and paying ransoms are evolving too. Darren Hopkins is head

(00:27):
of cy at mcgrar nickel, a great supporter of this podcast. Darren,
Welcome back to Fear and Greed.

Speaker 2 (00:31):
Thanks, Sean, good to be back.

Speaker 1 (00:33):
And Brendan Paine is a cyber partner at mcgrrah nickel. Brendan,
welcome back, Sean, thanks for having me again, Darren. In
its fifth year, mcgar nickel has partnered with you guv
to survey over eight hundred Australian business owners, partners, directors,
c suite leaders across businesses with fifty plus employees on
the ransomware threat facing Australian businesses. Very topical at the moment.

(00:55):
We've had some very high profile ransomware issues in recent weeks.
In fact, what can you tell us about the headline
result for twenty twenty five. How has the threat changed
compared to last year.

Speaker 2 (01:07):
A few things have changed. One of the things that
we've changed was the way we even did the survey
five years and we've had feedback every year and I
have to say my last year was probably some of
the most controversial and interesting feedback from my peers in
the market, all with our view as to what our
findings were showing and saying based on what they see
and what they experienced. So we took a different approach

(01:28):
and make sure we've got some real granular detail this year,
so we can look at size of businesses, sectors and
a range of other things to get that data that
we'll be asked to do headline. I guess coming out
of this year's survey we looked at more businesses at
this time because we wanted to get a broad across
section across what the Australian landscape looks like, and we
wanted to focus on businesses with fifty employees and more.

(01:51):
And the request on you GV was make sure this
represents what the country looks like. So we're a country
a small business, so we've got a factor in a
lot of small business. We can't just assume that this
is only a threat for the top end of town,
and that's what we've done headline results. It's still an issue.
Ransomware attacks still remain high. There's actually a lot of
good findings coming out of the survey this year which

(02:12):
we were really happy to see, notable decline in the
proportion of businesses that were paying. I mean previous years
we've been sort of highlighting how many are paying. This year,
forty four percent of the respondent's reported experience a ransomware
attack in twelve months, so's still a high number saying
that they had experienced a ransomware That's down from about
fifty six percent last year. What we did see this year,

(02:32):
and this is the one of the things I keep
getting question on, is that others are saying, I don't
see that ninety percent of those businesses were SMEs. They
were smaller businesses, So then vast majority of the brunt
of that attack is landing on the small businesses in
this country, whilst some of the big attacks are certainly
ones we see in the press, but that's a small proportion.
Another thing that we were really happy to see was

(02:52):
the amount being paid, so that's dropped from last year.
We were reporting one point three to five million being
that average payment, which is incredibly high, driven by some
really large payments this year seven hundred and eleven thousand,
So that's a significant reduction in that average payment that's
coming through and a great shift in attitude. So a
lot of businesses said that they would still be willing

(03:14):
to pay a ransom if attacked, but less than last year.
So previously have asked if you're attacked and you hadn't
actually experienced mine, which is still consider paying. So that's
actually falling away, which we're happy to see. If you
go in thinking, you know, you pay if it needed,
then that's part of that thought process you have. And

(03:34):
we've also seen the threats that are changing as well.
I mean, that's the other thing. Attackers are being a
little bit more sophisticated. We've seen double extortions, We're seeing
one thing in the press quite a lot our supply
chain being impacted, so others being attacked. That causes you
the issue, and that's a big change as well.

Speaker 1 (03:51):
What has caused the change in attitude behind the trend
the fact that people are less likely to pay. Why
is that happening?

Speaker 2 (04:02):
We asked the same question and there's a range of
factors sort of playing into that. One of the reasons
that we're seeing an attitude change is we constantly see
this going through the press. We constantly see others that
are in our supply chain being impact and we're getting
more familiar with what this means. There's a lot of
discussion around what it is you're doing if you pay,
I mean, you're supporting organized crime. And the government's view

(04:25):
has been always very very strong that that's something we
should we should stop doing, and there's no doubt that
this is an ecosystem we need to break. But there
was also some pol policy changes that that have actually
had a good influence on that as well. So with
the Cybersecurity Act coming through last year, there's now mandatory
reporting obligations around the payment of a ransom, and we've

(04:46):
never had that before. Previously when there was a ransom
where Bill proposed, the governments trying to work out how
do we actually put some enforcement around this attitude of
don't pay, and where we landed as if you're a
business with more than three million dollars and you make
a payment, you now actually have to tell a government
who you paid, what you paid, and the circumstances around that,
including a transcript of any negotiations that clearly has had

(05:10):
an impact on the willingness to pay. Interesting. I spoke
to a director who has actually had to pay a
ransom under the new regime, and I asked the question, Okay,
well did that come into and influence your decision around
making a payment? And ultimately that person said, I still
made the decision I made, and it was the right

(05:30):
decision for our business. We needed to pay for our business. However,
the reporting regime was interesting. He said that it actually
made him feel better about the process because he now
had to tell the government and it was almost like
an episode where I've done the wrong thing. I know
it's the wrong thing, but I'm going to go and
tell somebody because I'm supposed to, and it's like a
penance and I've been to confession and the feeling after

(05:52):
is I've done everything I needed to do now to
make that right. So interesting the way people perceive those
requirements and the other driver's reputational damage ninety two percent
of the surveyed businesses this year so that a breach
like this will negatively impact their business perception, and the
payment is a big driver and that if others to
know about.

Speaker 1 (06:12):
That, notwith saying we don't like cybercrime brandan that's a
bad However, some of these results that Darren's just run
through are actually improvements and where we've been What are
cyber criminals doing as a result. Are they changing the
way are they attack people? Are they attacking different sectors,
different sized enterprises.

Speaker 3 (06:32):
Yeah, it's a great question and a bit unpack and
Darren stolen all my headlines there, Sewan, so bear with me.
But look, I think you know what we're noticing is
a pretty significant drop in the number of Australian businesses
paying ransom so Darren said in twenty twenty five about
sixty four percent paid up, down from eighty four percent
the prior year, and the average payment is almost half

(06:53):
so again just over seven hundred thousand hour, down from
one point four. That said, though attacks are still happening
at a higher rate, we don't want to we don't
want to let that be the headline there. About forty
four percent of business businesses have based a ransomware incident
in the past year. So while fewer ransoms are being paid,
the volume of attacks hasn't really slowed down. Instead, cyber

(07:15):
criminals are changing their approach. You know, we're seeing far
more aggressive extortion tactics like threatening to leak stolen data,
as Darren referred to earlier. That's essentially known as double extortion.
They're casting a wider net and so they're hitting different
sectors and business sizes. You know, manufacturing and mid sized
companies are reporting more attacks, but really, at the end

(07:36):
of the day, no one's off the radar and no
one's safe. And interestingly, smaller, less sophisticated games are now
becoming more active, so you know, they're often asking for
payments via wire transfer, which is which is pretty uncommon.
I think it's such a shift away from the big
players who still prefer cryptocurrency as their main form of payment.

(07:57):
I was sort of having a think about this earlier,
and you know, I can recall several recent ransomware case
studies in which mcgrindical has assisted impacted businesses where there
has been a clear shift toward highly coordinated campaigns that
target multiple entities simultaneously, rather than the isolated, uncoordinated attacks
that we've seen in the past. So, you know, those campaigns,

(08:20):
there's a real sense of coordination between threat actors and
different threat groups that they're getting in through specific attack
vectors now often using what we referred to as zero
day vulnerabilities. The approach is stealthy as well, so the
goal is to avoid immediate disruption and focus on quietly
extra training and stealing data rather than causing obvious damage

(08:42):
to the environment and to the business. And then importantly,
you know these attacks are executed across several organizations at
once really to maximize the impact.

Speaker 1 (08:52):
Okay, Darren, how are restraining organizations then thinking about cybersecurity
given that and their incidant response strategies, particularly since they're
not paying reasons as much that they must have some
sort of other strategy in play here.

Speaker 2 (09:08):
And we've always wanted to get to the psyche behind
the why people do that, and that's why we started
this survey. We just wanted to understand why we thought
that this was an option every time. But at the
same time we're asking or what are you doing about
your business and how are you changing to adapt to
the risk. A lot of once again great positive outcomes,
and the survey around the number of businesses that are

(09:29):
focusing on being prepared building plans. One thing that we
have seen personally as a firm is the number of
businesses that are actually practicing those plans. We talk about
cyber simulations and cyber tabletops where boards and executives come
together to actually test that if they were to have
this issue play out, how would they be able to
respond and is everything they've done to prepare for it

(09:51):
going to be enough. The number one tabletop we do
is a ransomware event. Every board wants to go through
what would they do as business should they actually have
this issue play out? What decisions would they need to make,
and actually have the conversations and the debates early on
so that they can be prepared to actually move quickly.
That's something we're seeing more this year than we have

(10:12):
and that the survey results go and actually confirm that
as well, with the responds actually saying that they've done
those things. The last sort of thing we've sort of
seen is a real shift into businesses wanting to now
adopt intelligence to inform them as well. Now a lot
of these things are outed on the dark web. Some
businesses don't even know they've had an incident until their
data is for sale somewhere. Some of these attacks have

(10:34):
started because an employees lost their credentials online and it's
those credentials that are stolen and then maybe resolved that
are used to attack them. Intelligence is part of that
preparedness now, so they can know about these things well
before it becomes the ransomare incident. They're trying to avoid, Brandon.

Speaker 1 (10:50):
Why do you think that businesses have changed as such?
Is it because of the legislation? Is it because this
is a fifth year of the survey and they're hearing
a lot more about it? Then the next question after
that will it continue? Will they keep getting better at it?

Speaker 3 (11:05):
Yeah? I might just circle back to something Darren mentioned earlier, Sean,
So let me start with the new mandate and then
we'll get into I guess how businesses are a feeling
about the reporting. So earlier this year, the Australian government
introduced mandatory reporting for ransomware and cyber extortion payment. So essentially,
if a business turns over more than the three million

(11:27):
dollars and there are some exceptions, so Commonwealth and state
government bodies and certain critical infrastructure operators as well, they
now have to report any ransomware payment to the Australian
Signals Director within that seventy two hour period. If you
don't comply, the penalties range from I think just under
twenty thousand for individuals and up to ninety nine thousand

(11:49):
for companies. So the idea behind this is pretty clear,
improve visibility into ransomware incidents, disrupt the criminal business model,
and essentially help shape national policy, which is something that
came out in the strategy a few years ago. It's
still early days, though, but I guess we're seeing signs

(12:09):
that this is raising awareness and encouraging more transparent incident management.
That said, I think it's too soon to say whether
it's actually reducing attacks for now, though the government seemed
to be focused on education and compliance for the remainder
of this year rather than forcing penalties. If we look
at I guess the attitudes to reporting, our survey showed

(12:32):
that seventy one per cent respondents said they believe reporting
a ransomware attacked to authorities should be mandatory, and there's
a real strong sense that underreporting in the past has
really limited the government's ability to understand the threat landscape
and that sharing information is key to building a collective defense.
That said, though some businesses are still worried about reputational

(12:55):
risk and the possibility of regulatory scrutiny which really could
influence how willing they are to report. And honestly, I
wouldn't be surprised if we see a swing in the
reporting statistics twelve months from now when we do this again,
once the new regime has had time to bed in.

Speaker 1 (13:16):
Okay, Darren, Brendan, thank you for talking to Fear and Greed.

Speaker 2 (13:18):
Thanks all, Thanks all.

Speaker 1 (13:20):
That is Darren Hopkins, head of Cyber and Brendan Paine,
cyber partner at mcgrad Nicol, a supporter of this podcast.
I'm Seanaelmer, and this is Fear and Greed Q and
Day