July 30, 2014 By Derek Brink 3 min read

Ransom, which refers to some kind of payment that is demanded in exchange for the release of someone or something that has been taken, is a simple yet effective ploy that has been used by criminals for thousands of years.

For example, on his way home from the Third Crusade in 1192, King Richard the Lionheart was captured and held for ransom by Duke Leopold of Austria. The amount demanded was so large that it took over a year for England to raise it, giving root to the now-familiar idiom “a king’s ransom.” In 1932, the 20-month-old son of famous aviator Charles Lindbergh was kidnapped and held for ransom in one of the most high-profile cases in the history of the FBI.

The dynamics of ransom are not difficult to understand: I take something dear to you, and you pay me to give it back.

Ancient Approaches, Modern Applications

Today, criminals are applying these ancient approaches to modern technologies. Ransomware, one of the fastest-growing areas of cyber crime, refers to malicious software that is specifically designed to take control of a computer system or its data and hold it hostage so the attackers can demand payment from their victims. Although ransomware initially targeted PCs, it is now migrating to mobile platforms as well. Some recent public disclosures involving demands for ransom include:

  • The town of Greenland, New Hampshire, which lost eight years’ worth of data when it fell victim to a ransomware known as CryptoLocker.
  • Brokerage and investment advisory firm Benjamin F. Edwards, which exposed data related to some 430 New Hampshire residents from a ransomware called CryptoWall.
  • Domino’s Pizza in France and Belgium, where the personal information (including favorite pizza toppings) of about 650,000 customers was compromised. The hackers responsible demanded a ransom of 30,000 euros in exchange for not disclosing the information publicly.

Cyber Extortion: Related to Ransomware

Note that, technically, this last example is not ransomware (a type of malicious software), but rather a demand for ransom for compromised customer data. It seems that cyber criminals continue to move faster than the tech industry’s ability to create new jargon to describe it. In practical terms, it shows that we should also be aware of another ancient and effective exploit: extortion, which is the crime of taking money (or something else of value) from another party by use of threat or force. The dynamics of extortion are not difficult to understand, either: I cause (or threaten to cause) you harm, and you pay me to stop.

Unfortunately, there are also ample public disclosures related to cyber extortion:

  • News aggregator Feedly was the victim of a distributed denial-of-service (DDoS) attack in which the attackers demanded payment to make it stop.
  • Move Inc., an online real estate services provider, battled DDoS attacks that disrupted its website operations. It refused to respond to a demand for payment.
  • Evernote also battled a DDoS attack that disrupted operations, although it is unclear in this case whether the attackers also demanded payment.

Although these particular examples of cyber extortion are against larger-scale targets, it’s worth noting that the tactic can also be directed at smaller, personal targets — no one is really immune.

What You Need to Do

To protect against ransomware, now is the perfect time for organizations to remind themselves of some basic best practices:

  • Back up your data regularly (from an end user’s perspective, this is the easiest way out).
  • Ensure that your endpoints and servers are patched and up-to-date.
  • Deploy appropriate endpoint protection.
  • Regularly make end users aware of safe email and Web-browsing practices, and periodically test their behavior.

To protect against cyber extortion, it is essential for all organizations to understand the importance of developing a strong incident response capability to complement their traditional prevention-oriented security strategies. Prevention cannot be successful 100 percent of the time, so it makes sense to be capable of detecting and responding to incidents more quickly when they do occur. Note that incident response is not an action that an organization needs at a specific point in time; rather, it is a capability that an organization develops and uses when needed.

More from

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

The future of cybersecurity: What to expect at Black Hat 2024

3 min read - The cybersecurity landscape continues to evolve at a breakneck pace. New threats emerge daily, and the stakes have never been higher, especially as artificial intelligence (AI) is infused into every aspect of business. As security and business leaders, it's crucial to stay ahead of the curve and ensure your organization is equipped to handle the ever-changing threat landscape. For over two decades, Black Hat has been the premier gathering of cybersecurity professionals, providing a platform for experts to share knowledge,…

Recent CrowdStrike outage: What you should know

3 min read - On Friday, July 19, 2024, nearly 8.5 million Microsoft devices were affected by a faulty system update, causing a major outage of businesses and services worldwide. This equates to nearly 1% of all Microsoft systems globally and has led to significant disruptions to airlines, police departments, banks, hospitals, emergency call centers and hundreds of thousands of other private and public businesses. What caused this outage in Microsoft systems? The global outage of specific Microsoft-enabled systems and servers was isolated to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today