Falling victim to ransomware: on the unfolding of attacks, victim-offender interactions and decision-making

Abstract

Ransomware attacks have become a prominent cyberthreat for organisations, where malicious software is used to encrypt data and demand a ransom payment. This dissertation examines how ransomware attacks unfold and the decision-making processes and behaviour of victims, using a theoretical framework that combines environmental criminology and victimology. Various qualitative and quantitative methods were used, including analyses of court documents and negotiations, interviews with experts and surveys among entrepreneurs. The findings show that ransomware attacks revolve around a multi-stage process in a complex, professionalised ecosystem. Both offenders and victims exhibit bounded rational decision-making through cost-benefit analyses under time pressure and information asymmetry. Furthermore, the findings provide partial support for the use of the lifestyle-routine activity approach in explaining victimisation, as factors related to physical guardianship and target attractiveness were associated with increased vulnerability. Additionally, while non-victims reported a high intention to contact the police, there was substantial underreporting by actual victims, many of whom instead turned to private solutions. The dissertation extends established criminological frameworks to a contemporary form of cybercrime and addresses how the findings can inform preventive measures and ways to mitigate the consequences of victimisation and support victims.