Template-Type: ReDIF-Paper 1.0
Series: Tinbergen Institute Discussion Papers
Creation-Date: 2025-10-14
Number: 25-052/VII
Author-Name: Tom Meurs
Author-Workplace-Name: Dutch Police
Author-Name: Anna Cartwright
Author-Workplace-Name: Independent researcher
Author-Name: Edward Cartwright
Author-Workplace-Name: De Montfort University
Author-Name: Harold Houba
Author-Workplace-Name: Vrije Universiteit Amsterdam and Tinbergen Institute
Author-Name: Daniel Woods
Author-Workplace-Name: University of Edinburgh
Title: The Ransomware Pricing Paradox: An Empirical Study of the Six Stages of Ransomware Negotiations
Abstract: Ransomware has become the most common cyber risk for businesses. The rise is not driven by attackers using innovative attacks, but instead by deteriorating negotiation outcomes. The average payment grew by almost 20,000% since 2018. However, it remains unclear why attackers can demand ever higher ransoms. Our study explores potential explanations: lack of backups, cyber insurance, access to incident response (IR) firms, data exfiltration, and negotiating style. We model negotiation as a six-stage model: attacker intent, victim engagement, discount offer, discount magnitude, payment decision, and re-extortion. We test hypothetical explanations for ransom outcomes using two datasets: (1) 481 police-reported incidents (2019–2023); and (2) 237 negotiation transcripts from 23 ransomware groups. 
Classification-JEL: C7, D9, D22
Keywords: 
File-URL: https://papers.tinbergen.nl/25052.pdf
File-Format: application/pdf
File-Size: 563.767 bytes
Handle: RePEc:tin:wpaper:20250052