Too many companies have to ask themselves the challenging question, “Do I pay ransomware?” That’s because more than half (51%) of organizations Sophos surveyed for a new report said they have suffered a ransomware attack in the past year.

Researchers at Vanson Bourne conducted the survey of 5,000 IT managers around the world in January and February. If there is good news, organizations surveyed did see a slight drop in these types of cyberattacks.

The survey found that malicious hackers were successful in encrypting data 73% of the time, and in just 26% of those cases did victims get their data back by paying the ransom. A handful (1%) forked over the money but still didn’t get their data back.

Sophos’ Chet Wisniewski

“While many of us have suspected paying the ransom is a bad idea, now we finally have evidence that it’s true,” Chet Wisniewski, principal research scientist at Sophos, told Channel Futures. “The countries most likely to pay the ransom are also the countries [which] had the highest cost of recovery. On the whole, it is nearly twice as expensive to recover by paying the ransom.”

Wisniewski hopes these stats will discourage companies from paying up, which could curtail this style of ransom and extortion.

Ransomware Report Breakdown

The report also revealed:

Ransomware & Partners

Wisniewski says some partners are up to speed on ransomware, while others are behind the eight ball.

“The situation with partners largely mirrors what we see in the larger business world,” said Wisnieski. “Some get it, and some don’t. There are plenty of shops out there who are protecting themselves and their customers from ransomware and other threats. They take the time to ensure they are hardening credentials, keeping exposed services and hosts to a minimum, patching systems in a timely manner, and consulting with their customers to make sure they are putting security first.”

But Wisniewski says some bad guys are successfully phishing for partners’ management software credentials. Hackers can use that information to attack all of that partner’s customers at once.

“A lack of multifactor authentication coupled with weak credentials, privileged network access, and vulnerable management appliances will only lead to a devastating impact to you and your customers,” said Wisniewski.