Ransomware Recovery Risks: 34% of ANZ Organizations Choose to Pay Ransom Despite Ineffective Outcomes
A recent study reveals that 34% of organizations in Australia and New Zealand that faced ransomware attacks opted to pay the ransom. This trend persists despite the uncertain outcomes associated with such payments, indicating a troubling reliance on ransom as a recovery strategy. The findings highlight significant implications for cybersecurity practices in the region.
Ransomware Recovery Challenges and Concerns
The survey conducted by Commvault indicates that paying the ransom often fails to resolve the underlying issues. Among the organizations that chose to pay, 36% reported that the payment did not restore access to their data, or that attackers subsequently demanded additional funds. This raises critical concerns about the effectiveness of ransom payments as a viable recovery strategy.
Survey Scope and Methodology
The research involved a quantitative survey of 411 organizations across Australia and New Zealand. Participants included Chief Information Officers, Chief Information Security Officers, IT leaders, and other decision-makers. The study aimed to evaluate how these organizations prepare for cyber incidents and respond to ransomware disruptions.
Recovery Concerns and Planning Gaps
A key finding from the research indicates that recovery concerns significantly influence ransom payment decisions. Confidence in the integrity and completeness of backups emerged as a crucial factor when organizations consider paying a ransom. This reveals a substantial gap between investments in security tools and the confidence in recovery processes, suggesting that many organizations still doubt their ability to restore systems and data independently.
Additionally, the study identified a disconnect between business continuity planning and technology planning. While 61% of organizations defined the minimum business functions necessary to operate during a cyber crisis, only 43% had established the technology environments required to support those functions. Organizations that effectively aligned their business priorities with supporting technology were more likely to maintain operations and recover swiftly after a cyberattack.
Shifting the Recovery Conversation
Martin Creighan, Vice President for Asia Pacific at Commvault, emphasized that many businesses still treat ransomware as an immediate crisis rather than a preparedness issue. He noted that organizations often wait until the moment of crisis to make decisions about payment. By that time, they have already lost control of the situation. This perspective underscores the necessity of building robust recovery capabilities and regularly testing them before an attack occurs.
Establishing Recovery Priorities
Gareth Russell, Field CTO for Security in Asia Pacific at Commvault, advocated for organizations to establish recovery priorities prior to an incident. He highlighted the importance of identifying essential personnel, applications, systems, and data crucial for business continuity. Russell remarked that the conversation should shift from “How do we recover everything?” to “What must we recover first?” Organizations that define their Minimum Viable Company before an attack are better positioned to reduce downtime and uncertainty, thereby avoiding reliance on ransom payments as a recovery strategy.
The data reinforces the notion that ransomware is not merely a security issue but also an operational challenge. The fact that over one in three paying victims did not achieve a clean recovery underscores the limitations of viewing ransom payments as a reliable path back to normal operations.
For further insights into cybersecurity features, research, and analysis, visit Cyber Warriors Middle East.
Published on 2026-08-12 17:44:00 • By the Editorial Desk
