According to a new report by Kaspersky, in 88% of organizations around the world that were previously attacked by ransomware, business leaders would choose to pay a ransom if faced with another attack. At companies that had paid ransoms in the past, 97% were willing to do it again. Across organizations that have yet to be victimized, only 67% would be willing to pay.

Companies hit in the past were more inclined to pay as soon as possible to get immediate access to their data (33%, compared to 15% of companies that have never been victimized), or to pay after only a couple of days of unsuccessful decrypting attempts (30% vs. 19%).

Almost two-thirds (64%) of companies said they have experienced ransomware attacks, and 66% said they anticipate that one will happen at some point, viewing it as more likely than other common attack types, such as DDoS, supply-chain, APT, cryptomining or cyber-espionage.

Experts urge victims never to pay ransoms, since it doesn’t guarantee you get your data back and encourages criminals to continue their business. Instead, they recommend reporting incidents to local law enforcement as well as taking preventative measures, including setting up offline backups, keeping software on all corporate devices up to date, enabling ransomware protection on all endpoints, and focusing defense strategy on detecting lateral movements and data exfiltration to the internet.

Kaspersky conducted the survey of 900 respondents across North America, South America, Africa, Russia, Europe and Asia-Pacific in April 2022 across senior non-IT management (such as CEOs, VP and Director level) and business owners or partners at medium-sized companies and enterprises (50-1000 employees).

Read the full report by Kaspersky.