Should You Pay Ransomware Attackers to Save on Tax?

Ransomware attacks are increasingly prevalent in 2021 and, with a number of high-profile attacks in recent months, you’d be forgiven for thinking that these attacks are simply the cost of doing business nowadays.

When you get locked out of your computer by a ransomware attacker, you feel hopeless — but, of course, that’s the point. However, some creative accountants are claiming that businesses can actually use ransom payments to lessen their tax bills. And, with the average data breach costing more than $3.5 million, paying a ransomware demand could be a lucrative tax-deductible.

But is this actually a good idea? Or is it a poorly thought-out attempt to make the best of a bad situation?

Can You Lower Your Business’ Tax Bill by Paying a Ransomware Demand?

In the US, businesses can claim money stolen by extortion — such as paying a ransom — back on their tax demands. In the eyes of some accountants, this could provide a silver lining for affected businesses.

In fact, the IRS in Revenue Ruling 72-112 stated that ransom payments qualify as a theft loss deduction as long as the extortion was illegal in the state where it occurred. However, any costs that are covered by insurance are, sadly, not deductible. Of course, the amount that can be deducted from a business’ tax bill depends on the size of the ransom, the business’ earnings, and a host of other factors.

If you’re an individual taxpayer, however, ransom payments are not tax-deductible. In fact, according to IRC Section 165(c), taxpayers can only deduct the cost of non-business-related data breaches if the loss arose from a casualty such as a fire, storm, shipwreck, or theft. What’s more, when Congress passed the Tax Cuts and Jobs Act 2017, they stated that casualty losses can only be considered deductible if they are attributable to a federally declared disaster. So, in short, never.

Should you Pay a Ransom Demand?

Absolutely not — while it might seem to be the only way out for businesses or individuals, paying the ransom is no guarantee of a return to normality, tax savings or not.

“The FBI does not support paying a ransom to the adversary. Paying a ransom does not guarantee an organization will regain access to their data; in fact, some individuals or organizations were never provided with decryption keys after having paid a ransom,” the FBI says. “Paying a ransom emboldens the adversary to target other organizations for profit, and provides for a lucrative environment for other criminals to become involved. While the FBI does not support paying a ransom, there is an understanding that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.”

In fact, ransomware attackers have become so emboldened that, according to BitDefender, the number of attacks jumped by 715% in 2020 — yes, 715%. Ransomware attacks now make up more than 80% of all financially motivated cyber attacks.

Ransomware attacks have become so lucrative that some attackers function more like companies than lone hackers or criminal gangs. The DarkSide gang which shut down the Colonial Pipeline last month reportedly operates using a “ransomware as a service” business model. DarkSide, rather than carrying out the attacks itself, develop the software needed to carry out an attack and then sells that software to third parties to do the dirty work.

Can You Stop a Ransomware Attack?

Yes, and you’d be surprised how easily ransomware attacks can be prevented — for businesses and regular people alike.

VPNs, for example, can hide personal and business data from the prying eyes of ransomware attackers. By routing your traffic through secure servers, you essentially become anonymous online — making it all but impossible for attackers to work out where the traffic is coming from and, as a result, who they should target.

Perimeter81, for example, is a great choice for businesses looking to secure their data. It operates a zero-trust model which mandates that anything inside or outside of your organization’s perimeters has to verify before connecting to the network — giving you complete control of all your data. What’s more, Perimeter 81’s pricing starts from just $8 per month, per user — significantly less than the cost of any data breach or ransom payment.

For individuals, we would recommend NordVPN to protect against ransomware attacks.  You’ll be able to route your data through more than 5,000 servers around the world without impacting your internet speeds too much. What’s more, NordVPN is cheap, and you can get started from just $3.71 per month.