This study uses data from online moderated interviews with 33 ransomware victims to examine victim decision-making during a ransomware attack.
While ransomware attacks could be a fear-inducing and stressful experience, victims logically assessed the threat and weighed up their responses. Victims commonly found practical ways to restore their data and systems, often with advice and support from trusted sources.
Victims rarely tried to negotiate with offenders. The vast majority of victims decided against paying the ransom because they distrusted the offenders.
Victims are capable of rational decision-making following ransomware attacks even during periods of heightened stress and emotion. Support and resources to help victims assess the risks associated with a ransomware attack and to restore their data and devices must be readily accessible when ransomware attacks occur.
References
URLs correct as at February 2026
Angie AD, Connelly S, Waples EP & and Kligyte V 2011. The influence of discrete emotions on judgement and decision-making: A meta-analytic review. Cognition and Emotion 25(8): 1393–1422. https://doi.org/10.1080/02699931.2010.550751
Australian Cyber Security Centre nd. Report and recover from ransomware. https://www.cyber.gov.au/report-and-recover/recover-from/ransomware
Australian Signals Directorate 2024. Annual cyber threat report 2023–2024. Canberra: Australian Signals Directorate. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2023-2024
Australian Signals Directorate nd. Ransomware. https://www.cyber.gov.au/threats/types-threats/ransomware
Bartholomeyczik K, Gusenbauer M & Treffers T 2022. The influence of incidental emotions on decision-making under risk and uncertainty: A systematic review and meta-analysis of experimental evidence. Cognition and Emotion 36(6): 1054–1073. https://doi.org/10.1080/02699931.2022.2099349
Connolly & Borrion 2022. Reducing ransomware crime: Analysis of victims’ payment decisions. Computers & Security 119: 102760. https://doi.org/10.1016/j.cose.2022.102760
Cornish DB & Clarke RV 2014. The reasoning criminal: Rational choice perspectives on offending. New York: Routledge. https://doi.org/10.4324/9781315134482
Criado-Perez C, Jackson C, Minbashian A & Collins CG 2024. Cognitive reflection and decision-making accuracy: Examining their relation and boundary conditions in the context of evidence-based management. Journal of Business and Psychology 39: 249–273. https://doi.org/10.1007/s10869-023-09883-x
Ferrer RA, Ellis EM, Orehek E & Klein WMP 2022. Fear increases likelihood of seeking decisional support from others when making decisions involving ambiguity. Journal of Behavioral Decision Making 35(3): e2266. https://doi.org/10.1002/bdm.2266
Geißler CF, Friehs MA, Frings C & Domes G 2023. Time-dependent effects of acute stress on working memory performance: A systematic review and hypothesis. Psychoneuroendocrinology 148: 105998. https://doi.org/10.1016/j.psyneuen.2022.105998
Hull G, John H & Arief B 2019. Ransomware deployment methods and analysis: views from a predictive model and human responses. Crime Science 8(2). https://doi.org/10.1186/s40163-019-0097-9
Institute for Security and Technology 2021. Combating ransomware: A comprehensive framework for action: Key recommendations from the Ransomware Task Force. https://securityandtechnology.org/ransomwaretaskforce/
Kahneman D 2011. Thinking, fast and slow. New York: Farrar, Straus and Giroux
Kahneman D 2003. A perspective on judgement and choice. American Psychologist 58(9): 697–720. https://doi.org/10.1037/0003-066x.58.9.697
Matthijsse SR, Van ‘t Hoff-de Goede S & Leukfeldt ER 2025. To report or not to report: Exploring the motivations and factors associated with reporting of ransomware victimisation among entrepreneurs. Journal of Criminal Justice 97: 102378. https://doi.org/10.1016/j.jcrimjus.2025.102378
Matthijsse SR, Van ‘t Hoff-de Goede S & Leukfeldt ER 2023. Your files have been encrypted: A crime script analysis of ransomware attacks. Trends in Organized Crime. https://doi.org/10.1007/s12117-023-09496-z
McIntyre D & Frank R 2021. No gambles with information security: The victim psychology of a ransomware attack. In M Weulen Kranenbarg & R Leukfeldt (eds), Cybercrime in context: The human factor in victimization, offending, and policing. Cham: Springer: 43–60. https://doi.org/10.1007/978-3-030-60527-8_4
Meurs T 2025. Double-extortion ransomware: A study of cybercriminal profit, effort, and risk (doctoral thesis). University of Twente, Enschede, Netherlands. https://doi.org/10.3990/1.9789036564182
Nicholson J, Morrison B, Dixon M, Holt J, Coventry L & McGlasson J 2021. Training and embedding cybersecurity guardians in older communities. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. New York: Association for Computing Machinery: 1–15. https://doi.org/10.1145/3411764.3445078
Patyal M, Sampalli S, Qiang Y & Rahman M 2017. Multi-layered defense architecture against ransomware. International Journal of Business and Cyber Security 1. https://www.researchgate.net/publication/315471509_Multi-layered_defense_architecture_against_ransomware
Voce I & Morgan A 2025. Ransomware targeting individuals and small businesses: Vulnerabilities and impacts. Trends & issues in crime and criminal justice no. 724. Canberra: Australian Institute of Criminology. https://doi.org/10.52922/ti78106
Voce I & Morgan A 2023. Cybercrime in Australia 2023. Statistical Report no. 43. Canberra: Australian Institute of Criminology. https://doi.org/10.52922/sr77031
Voce I & Morgan A 2022. Help-seeking among Australian ransomware victims. Statistical Bulletin no. 38. Canberra: Australian Institute of Criminology. https://doi.org/10.52922/sb78504
Voce I & Morgan A 2021. Ransomware victimisation among Australian computer users. Statistical Bulletin no. 35. Canberra: Australian Institute of Criminology. https://doi.org/10.52922/sb78382
Wake S, Wormwood J & Satpute AB 2020. The influence of fear on risk taking: A meta-analysis. Cognition and Emotion 34(6): 1143–1159. https://doi.org/10.1080/02699931.2020.1731428