The business of ransomware and its effects on business

Dr. Richard Frank’s Business of Ransomware project examines how Canadian businesses experience, report, and respond to ransomware attacks. Drawing on survey data from 176 business respondents, the research explored where affected organizations were located, what sectors they represented, how they prepared for cyber incidents, and what happened after an attack. The study found that the majority of respondents were in the professional and technical services industry, though, about a quarter were in the retail and finance sectors.

The research highlights several important patterns in organizational response. Many businesses reported keeping software updated and providing suspicious-email training, but ransomware still caused serious disruption, with some organizations losing access to most or all of their networks. Businesses used a range of recovery strategies, including restoring from backups, relying on internal IT teams, hiring external recovery services, and, in some cases, paying the ransom. One especially notable finding was that paying did not guarantee recovery: only about half of those who paid had their systems restored, while others saw no result or were asked for more money.

Dr. Frank’s work points to clear lessons for both businesses and public agencies. For organizations, the central recommendation is to ensure they can reliably recover from ransomware, accidental deletion, hardware failure, or other data-loss events, with backups serving as the strongest protection. For law enforcement and government, the research suggests a need to simplify and harmonize ransomware reporting so businesses know exactly where to turn. By clarifying reporting pathways and encouraging incident reporting, the findings can help improve both organizational resilience and the public response to cybercrime.