That is the problem right there. Someone just made 5MM tax free. Time to make paying ransomware illegal and that will stop the potential criminal market for ransomware attacks apart from political motivations.
Every ransom paid just funds and encourages the next hack. The social damage is deserving of a large fine (i.e. 10x the ransom).
"The decryption software provided by the hacking group DarkSide, notes Bloomberg, was reportedly 'so slow' that Colonial Pipeline 'continued using its own backups to help restore the system.'"
Source- https://mashable.com/article/colonial-pipeline-paid-bitcoin-...
Realistically, yes, the hack would still happen. Because there will never be a world where people don't pay ransoms, especially if they have no other options / backups.
> More importantly, would the hack have happened in first place if they knew there was no chance of being paid?
Why wouldn't it? They could easily been paid by another group to perform the hack, used the hack to manipulate stock prices, sold the stolen financial data, or, most likely, the ransom would have been paid indirectly though some other means, like hiring a "cyber security consultant."
Continuing to let them do this with impunity is going to lead to escalated attacks.
Would posting a paper by the german federal police on a practical home heroin manufacture be doing the criminals job? https://www.unodc.org/pdf/research/Bulletin07/bulletin_on_na...
Irregardless the groups that pulled this off already know this and have machinery like that which was revealed in the panama papers and crypto mixers ready to launder the money.
What is now needed is to give real consequences to US-based companies and institutions that pay any sort of ransom to the state/non-state actors that are perpetrating these hacking events. This will remove the profit motive, and I don't care if it's Colonial Pipeline or UCSF, this behavior needs to stop and the criminals behind it need to know that there is not any money to be made.
I don't think that's going to fix anything. I'm 100% sure companies will just pay quietly and not talk about it. Which makes this infinitely worse.
The government invests a crap ton in defense, this should be part of it.