CoChat
Sign Up
Cited by 37Information and Cyber SecurityDigital Platforms and EconomicsCybercrime and Law Enforcement Studies

Economics of ransomware: Risk interdependence and large-scale attacks

August, Terrence, Dao, Duy, Niculescu, Marius Florin·2022·Management Science
DOI 10.1287/mnsc.2022.4300
Open this paper in CoChat — free account

Abstract

Recently, the development of ransomware strains and changes in the marketplace for malware have greatly reduced the entry barrier for attackers to conduct large-scale ransomware attacks. In this paper, we examine how this mode of cyberattack impacts software vendors and consumer behavior. When victims face an added option to mitigate losses via a ransom payment, both the equilibrium market size and the vendor’s profit under optimal pricing can actually increase in the ransom demand. Profit can also increase in the scale of residual losses following a ransom payment (which reflect the trustworthiness of the ransomware operator). We show that for intermediate levels of risk, the vendor restricts software adoption by substantially hiking up price. This lies in stark contrast to outcomes in a benchmark case involving traditional malware (non-ransomware) where the vendor decreases price as security risk increases. Social welfare is higher under ransomware compared with the benchmark in both sufficiently low- and high-risk settings. However, for intermediate risk, it is better from a social standpoint if consumers do not have an option to pay ransom. We also show that the expected ransom paid is nonmonotone in risk, increasing when risk is moderate despite a decreasing ransom-paying population. For ransomware attacks on other vectors (beyond patchable vulnerabilities), there can still be an incentive to hike price. However, market size and profits instead weakly decrease in the ransom amount. When studying a generalized model that includes both traditional and ransomware attacks, our results remain robust to a wide range of scenarios, including threat landscapes where ransomware has only a small presence. This paper was accepted by Kartik Hosanagar, information systems. Funding: This work has been supported by the Haskayne School of Business' Dean's Research Grant and by an award from the Georgia Institute of Technology Center of International Business Education & Research as part of its funded research program. Supplemental Material: The online appendix is available at https://doi.org/10.1287/mnsc.2022.4300 .

Integrity signals

Registry

Crossref · 10.1287/mnsc.2022.4300

Cites

37 of 37 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Ransomware attacks raise questions about the reliability of financial reporting data and result in significant financial and reputational harm to companies that fall victim to them.

    “Ransomware attacks raise questions about the reliability of financial reporting data, and they result in significant financial and reputational harm to companies that fall victim to them (August, Dao, and Niculescu 2022).”

    From Colonial Pipeline: Responding to a Ransomware Attack in the Energy Sector (2026) · cites this paper as August, Dao, and Niculescu 2022

Cites

Flagged first, then by citations

Research works printed but not linked: 4

  1. August T, 2019, Management Sci., 65, 4451
  2. Dey D, 2015, J. Comput., 27, 462
  3. Lapan H, 1988, Amer. Econom. Rev., 78, 16
  4. Yang L, 2019, IEEE Trans. Systems Man Cybernetic Systems

Cited by

Sorted by citations

Related

Authors
August, T., Dao, D., & Niculescu, M. F.
Affiliations
  • University of California San Diego (US)
  • University of Calgary (CA)
  • Georgia Institute of Technology (US)
ORCID
Venue
Management Science
Publisher
Institute for Operations Research and the Management Sciences (INFORMS)
Published
2022-12
Volume
68
Issue
12
Pages
8979-9002
ISSN
  • 0025-1909 (ISSN-L)
  • 1526-5501
DOI
10.1287/mnsc.2022.4300
OpenAlex
W4220970108
Cited by
37
References
37
Citations by year
2026: 13 · 2025: 9 · 2024: 11 · 2023: 2 · 2022: 1 · 2020: 1
FWCI
5.69
Type
journal article
Language
en
Open access
closed
Locations
Management Science (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Business, Management and Accounting › Strategy and Management › Digital Platforms and Economics
  • Social Sciences › Law › Cybercrime and Law Enforcement Studies
Keywords
ransomware, ransom payments, software companies, securities pricing, risk interdependence, consumer behavior, social welfare (welfare economics), security risks, software adoption, optimal pricing

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review