@masek If the sole reason for paying is to reduce harm to the company or entity, then I tend to agree with you.
But let's look at the Instructure situation. It was a #hackandleak situation with data that is not particularly valuable, so why pay, right?
But then the attackers escalated and disrupted Finals week for tens of thousands of schools and millions of students.
And if Instructure hadn't paid, would ShinyHunters keep attacking them and disrupting their ability to provide the software schools rely on? My bet is that they would have.
When Instructure paid, I viewed it as them paying to stop the attacks more than to (just) allegedly delete data.
And that was not to reduce harm to the business, although Lord knows, their reputation was taking quite a hit, but paying reduced the disruption and harm to the students and teachers and schools.
And I'm okay with that. Does the payment reward criminals and make more crime more likely? Maybe. But even if the answer is "definitely," the company had a duty to mitigate harm to those who entrusted them with their data. And if that means paying, then their first duty is still to the ultimate victims and not to other companies.
I feel even more strongly when the target is a healthcare entity and patient services are delayed, or emergency services are diverted elsewhere.
I know, I know.... some people probably hate me for this opinion. To those who disagree with me strongly:
Change my mind. And show me some actual data about how often some gangs do or do not keep their word.
@amvinfe @euroinfosec
Dissent Doe 