As I have commented on earlier, ransomware attacks are focusing on institutions and are causing high impact outages. As this Announcement from the University indicates, they have paid a ransom and are in the process of getting their systems back. As the Kansas Heart Hospital found out, sometimes paying the ransom get your systems back. The hospital had to invoke their recovery processes after the hijackers requested additional money. As the phrase goes, there is no honor among thieves.
Although the blockchain technology behind bitcoin is being investigated and in trials in a variety of industries, it unfortunately does allow the ransom to be untraceable. While neither story explicitly indicates bitcoin was used to pay the ransom, it is becoming a de jure standard.
While many insurance policies do include coverage for these attacks, it is the reputational and operational risks that insurance doesn’t cover. As digital transformation separates the digital predators from the digital prey, this is another risk that must be addressed and managed.