Companies pay hackers around 20 million rubles to recover data after cyberattacks, according to RED Security SOC data. Analysts at the center studied over 100 incidents involving ransomware. The average initial demand is about 50 million rubles in cryptocurrency, but companies ultimately pay approximately half that amount — around 15–20 million rubles.
8 out of 10 companies enter into negotiations with hackers. The ransom amount depends on the volume of data and the size of the victim's business; in half of the cases, it exceeds 100 million rubles. Experts emphasize that the attackers' willingness to negotiate does not mean that paying the ransom is safe. Transferring funds does not guarantee full data recovery and encourages further attacks. RED Security SOC experts emphasize:
The very fact that attackers are willing to negotiate does not mean that paying the ransom is a reasonable or safe solution. Transferring funds does not guarantee full data recovery and encourages further attacks on the same organization.
RED Security SOC recommends that in the event of an attack, affected systems should be immediately isolated, files should not be deleted, and compromised machines should not be rebooted, as this can complicate forensic analysis and data recovery.