Valuation of confidentiality and availability in a personal ransomware attack scenario

Gassmann F, Beck J, Gourmelon N, Benenson Z (2025)

Publication Type: Journal article

Publication year: 2025

Journal

Journal of Cybersecurity Oxford University Press (OUP): Policy C - Option D / Oxford University Press

Book Volume: 11

Article Number: tyaf022

Journal Issue: 1

DOI: 10.1093/cybsec/tyaf022

Abstract

To understand what is more valuable, availability or confidentiality of the data on a private computer, we conducted an online survey experiment with over 800 German participants assigned to one of the two scenarios: ransomware demanding payment for availability versus for confidentiality of their data. Half of the participants was recruited at the platform Clickworker, and another half was recruited at various German universities. We find that 43.7% of respondents would pay for availability, whereas 38.6% would pay for confidentiality, this difference being not statistically significant and independent of the sample. The median of non-zero payments for Availability is 50 EUR in both samples, whereas for Confidentiality, Clickworkers were willing to pay median 30 EUR, and the University sample median 100 EUR. The probability of paying for young and elderly people is higher than for middle-aged ones, whereas sex, marital status and having children has no influence. Good backup quality and low income predict refusal to pay for availability, but not for confidentiality. In both scenarios, belief that the offenders will keep their promise and feeling scared predict payment, whereas belief that the payment is immoral and feeling strong negative emotions predict refusal to pay. Once the person decided to pay, the high emotional value of their files, as well as high social media usage predict higher payment value.

Authors with CRIS profile

Nora Gourmelon Lehrstuhl für Informatik 5 (Mustererkennung) Zinaida Benenson Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Involved external institutions

Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau (RPTU) DE Germany (DE) Boston Consulting Group GmbH DE Germany (DE)

How to cite

APA:

Gassmann, F., Beck, J., Gourmelon, N., & Benenson, Z. (2025). Valuation of confidentiality and availability in a personal ransomware attack scenario. Journal of Cybersecurity, 11(1). https://doi.org/10.1093/cybsec/tyaf022

MLA:

Gassmann, Freya, et al. "Valuation of confidentiality and availability in a personal ransomware attack scenario." Journal of Cybersecurity 11.1 (2025).

BibTeX: Download