Key Takeaways

  • Nearly every Australian organization hit by ransomware pays the demand, trailing only Singapore in regional frequency.
  • Payment rarely equates to full restoration, with very few organizations recovering all their data post-payment.
  • The disconnect between payment willingness and technical recovery highlights the fallibility of criminal encryption tools.

In Australia, Rubrik said 95 per cent of organisations that experienced a ransomware attack paid the ransom. It said this ranked behind Singapore at the very top of the regional leader board for payment willingness, illustrating a desperate trend among business leaders in the Asia-Pacific region.

When a screen locks up and operations grind to a halt, the checkbook comes out. It’s a reflexive, panic-driven response. Executives look at the daily cost of downtime, compare it to the ransom demand, and decide that paying is the "pragmatic" business decision.

But is it?

The data suggests the return on investment for paying extortionists is abysmal. While 95 per cent of Australian victims paid up, the percentage of those organizations that actually recovered 100 per cent of their data is shockingly low—sitting at roughly 14 per cent.

Here’s the thing about doing business with criminals: customer service isn’t their strong suit.

There is a pervasive myth in the boardroom that a ransomware transaction is a clean swap. You send the Bitcoin; they send the decryption key; business resumes. In reality, the process is messy, technically fraught, and rarely results in a clean slate.

Part of this comes down to the "honesty" of the attackers, sure. But a surprisingly large factor is simply bad software engineering. Ransomware groups operate like startups, pushing out minimum viable products. Their decryptors are often buggy, slow, or outright broken. You might get a key that works on 80 per cent of your files while the other 20 per cent—likely the mission-critical databases you actually need—remain corrupted beyond repair.

Why do we keep paying then?

Psychologically, it feels like taking control. In a cyberattack, the victim feels helpless. Paying is an action. It’s a lever you can pull. There is also the pressure of the "double extortion" tactic. Modern ransomware gangs don’t just encrypt data; they steal it. They threaten to leak sensitive IP or customer records if the money isn’t sent. This shifts the calculation from purely "data recovery" to "reputation management."

However, the willingness to pay creates a vicious economic cycle. Australia and Singapore marking themselves as high-percentage payers signals to global threat actor groups that these are profitable hunting grounds. If 95 per cent of targets in a specific geography pay, that geography becomes a priority target.

It’s worth noting a micro-tangent here regarding cyber insurance. For years, insurers were somewhat complicit in this cycle, often covering the cost of the ransom because it was cheaper than covering the cost of prolonged business interruption. That tide is turning. Premiums are skyrocketing, and policies are increasingly excluding ransom payments or demanding strict proof of due diligence before paying out. The safety net is getting holes in it.

Technology leaders need to look at the 14 per cent recovery statistic and use it to change the internal narrative.

Recovery strategies that rely on the attacker are doomed to fail. The conversation has to shift from "How do we stop them getting in?" (because eventually, they will) to "How fast can we bounce back without asking them for a key?"

Immutable backups are the only real leverage an organization has. If your backup data cannot be encrypted or deleted by the attacker, you have the option to tell them to get lost. It’s painful to rebuild, yes. It takes time. But relying on a buggy decryptor provided by a criminal syndicate is a strategy based on hope, not logic.

Paying the ransom funds the R&D for the next attack. It funds the purchase of zero-day exploits and the recruitment of affiliates.

Global trends are slowly shifting. Governments are debating banning ransomware payments entirely to break the business model. Until then, Australian businesses remain some of the most lucrative customers for cybercriminals. The 95 per cent payment rate is a statistic that needs to drop, not because the attacks are stopping, but because the payments are proving to be a waste of money.