Ransom demands an additional 40% of ransom attacks - Expert: ``Payment is not the solution'' - Unauthorized access

The damage caused by ransomware, a virus that encrypts data for ransom, is rapidly increasing. Studies have shown that even after paying the ransom, about 40% of the ransoms are still demanded, and experts are warning that ``Payment is not the solution.''

3,600 personal information leaked at Ministry of Foreign Affairs, unauthorized access in July

Proofpoint, an American information security company, conducted a survey of 953 security experts from 12 countries around the world and compiled responses from 803 people who had actually experienced the damage.

According to the survey results released on the 27th, in 2025, the United States was the most likely country to pay a ransom after a ransom attack at 93%, followed by the United Arab Emirates (UAE) at 81% and India at 64%. Japan was third from the bottom at 37%.

When we checked the status of Japanese companies that had paid, we found that only 59% had their data or access rights restored in one go, and 37% were required to make additional payments. 4% of companies lost contact with the attacker after making the first payment.

According to the National Police Agency, 123 cases of ransom attacks were confirmed between January and June of this year, the highest number on a half-yearly basis since 2020, when statistics are still available.

Yukimi Masuda, managing director of Proofpoint Japan, the company's Japanese subsidiary, points out that one reason for the rapid increase is that the Japanese language, which used to be a barrier for foreign attackers, has become easier to manipulate naturally due to advances in artificial intelligence (AI).

On top of that, we analyzed that current ransom attacks are shifting from simply encrypting systems and files to attacks that steal data and then repeatedly demand money. Even if the data were recovered after paying the ransom, ``It is not a reliable means of recovery, nor does it guarantee deletion of stolen information. We need a system that allows us to recover on our own.''

In October, unauthorized access to GMO Internet was revealed, but instead of responding to demands for money, the situation developed into a situation where attackers released personal information.

Masuda said, ``Maybe by making people think that targeting Japanese companies has low return on investment, we can reduce the number of financially motivated attacks.''