Comment by Veserv | Hacker News Reader

Comment by Veserv | Hacker News Reader

What a cheesy attack. It only cost them $1.14M to get their data back. I can not tell if the attack hit something inconsequential, the criminals are stupid, or they just do not understand finances for them to ask for such a tiny sum.

UCSF received $1.43B in grants and contracts during 2017-2018 [1]. Assuming they are generating an equivalent amount of value in knowledge evenly distributed over time, the loss of one day of research would be ~$3.9M. So, if the the last whole organization backup was one day ago and the attackers were only able to stop access to the last day of work since they did not think to corrupt the backups before they went out, then the ROI of paying off the ransom would be ~3.43. If they were able to affect the entire organization for an entire week, then the cost would be ~$27.3M with an ransom ROI of ~24.

So, assuming they did any damage of consequence, asking for ~$1.14M seems like robbing a person at gunpoint for their pocket lint.

[1] https://www.ucsf.edu/news/2019/02/413396/ucsf-top-public-rec...

You make the assumption here that this hack halted all research. It's unlikely to have even affected 10% of ongoing research. Plenty of things stored on cloud storage, in email, in personal computers, on computers not locked out, etc.

Doesn't matter, it's the perfect crime...

The encryption is done on the user's machine using their processing power, and there's virtually no downside for you (either they pay and you decrypt or they don't and you just dissapear).

Ransomware will be an issue for years to come.

I am confused by your response since it seems to agree with my post but you used words that indicate you think that they do not agree. Did you mean to reply to someone else?

I am saying that that the ransom is hilariously small compared to what they would probably be able to get. So, when they realize they can actually ask for a number that is not a rounding error they will probably increase the number/outcome of attacks. They are criminals robbing people at gunpoint and only asking for their pocket lint. Once they all realize they can ask for a wallet and get it, I think the number is going to go way up.

On the other hand, the more they ask for, the less likely they’re going to get paid for it.

If they keep asking for $1M from organizations that will pay because that’s pocket change, the more organizations they can attack.

If they start asking for too much, they’ll see they won’t pay as quickly, other people will start selling services to protect against you that seem more attractive, etc.

Reply on news.ycombinator.com