Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Ransomware topic
No spam. Unsubscribe anytime.
Presenter: ransomware can force companies to choose between paying ransom or lengthy restores
Summary
Eric Souza recounted a large ransomware incident that encrypted 20,000 machines and initially sought $2.5 million; he said organizations often pay because restoring operations across many sites can take months even when backups exist.
Souza described a ransomware incident affecting a company with thousands of machines and hundreds of locations, saying the attackers first demanded $2,500,000 and that the company negotiated a lower amount. He explained the practical calculus organizations face: "If you get ransomed, here are the options. You pay the ransom or you restore from backup. There's no 3rd option."
He emphasized restoration is not just a technical matter but an operational one—restoring tens of thousands of endpoints can take months—and recommended immutable backups and tested restoration procedures as key defenses. He also noted federal law-enforcement limits: in the example he discussed, the Department of Justice identified the attacker group but said action was constrained when groups have nation-state backing.
