Skip to the main content.
What Size Law Firm Are You?

We've crafted solutions tailored to your firm

Insurance Glossary

The world of insurance for law firms can be confusing, and difficult to navigate. We've created this glossary because these common insurance terms should be easy to understand.

← Blog Home

If You Are Hit by Ransomware, Do You Negotiate? If So, How?

1 min read

If You Are Hit by Ransomware, Do You Negotiate? If So, How?

The following post was originally published on October 1 on the Ride The Lightning Blog by Sensei Enterprises, Inc. 

If You Are Hit by Ransomware, Do You Negotiate? If So, How?

Man, that’s a good question. Why would you ever pay? Especially if you have good backups?

As cybersecurity expert Bruce Schneier notes in a blog post, there are solid arguments for and against paying a ransom.

Arguments cited by Schneier for making a ransomware payment include:

  • Payment is the least costly option;
  • Payment is in the best interest of stakeholders (e.g. a hospital patient in desperate need of an immediate operation whose records are locked up);
  • Payment can avoid being fined for losing important data;
  • Payment means not losing highly confidential information; and
  • Payment may mean not going public with the data breach.

The arguments against making a ransomware payment include:

  • Payment does not guarantee that the right encryption keys with the proper decryption algorithms will be provided;
  • Payment further funds additional criminal pursuits of the attacker, enabling a cycle of ransomware crime;
  • Payment can do damage to a corporate brand;
  • Payment may not stop the ransomware attacker from returning;
  • If victims stopped making ransomware payments, the ransomware revenue stream would stop and ransomware attackers would have to move on to perpetrating another scheme; and
  • Using Bitcoin to pay a ransomware attacker can put organizations at risk. Most victims must buy Bitcoin on entirely unregulated and free-wheeling exchanges that can also be hacked, leaving buyers’ bank account information stored on these exchanges vulnerable.

As Bruce says, “When confronted with a ransomware attack, the options all seem bleak. Pay the hackers ­ and the victim may not only prompt future attacks, but there is also no guarantee that the hackers will restore a victim’s dataset. Ignore the hackers ­ and the victim may incur significant financial damage or even find themselves out of business. The only guarantees during a ransomware attack are the fear, uncertainty and dread inevitably experienced by the victim.”

There are professionals who handle the negotiation of ransomware demands. You can read an interview with one of these professionals from a Red Tape Chronicles post.

It is, to put it mildly, educational.

Hat tip to Dave Ries.



Sharon D. Nelson, Esq., is the President of Sensei Enterprises, Inc., a digital forensics, cybersecurity and information technology firm in Fairfax, Virginia. Ms. Nelson is the author of the noted electronic evidence blog, Ride the Lightning and is a co-host of the Legal Talk Network podcast series called “The Digital Edge: Lawyers and Technology” as well as “Digital Detectives.” She is a frequent author (eighteen books published by the ABA and hundreds of articles) and speaker on legal technology, cybersecurity and electronic evidence topics. She was the President of the Virginia State Bar June 2013 – June 2014 and a past President of the Fairfax Law Foundation and the Fairfax Bar Association. She may be reached at

3 Safety Measures Your Firm Should Implement to Avoid Wire Transfer Scams

3 min read

3 Safety Measures Your Firm Should Implement to Avoid Wire Transfer Scams

We have received a steadily increasing number of notices from our insureds relating to fraudulent wire transfers. This increase in wire scams is...

Read More
Does Your Law Firm Need Cyber Coverage?

1 min read

Does Your Law Firm Need Cyber Coverage?

The short answer is yes. The common thought most law firms have is, “I’m too small a fish to worry about being hacked . . . there are bigger fish to...

Read More
Attorneys Beware: The Check Scam

2 min read

Attorneys Beware: The Check Scam

It has never been easier than the present day to conduct law firm business without ever meeting clients in person. The result is greater efficiency...

Read More