Almost nobody reports a ransomware attack, even though nine in ten business owners say they would

You would report it if ransomware hit your business. That is what nine in ten Dutch business owners say when you ask them in advance. In practice, fewer than one in five actually do. That gap between what people say and what they do sits at the heart of a PhD dissertation by criminologist Sifra Matthijsse, who defended her research at Leiden University on 7 October on how ransomware attacks unfold and how victims decide to respond. The study is Dutch, built on Dutch victims and Dutch police data, but the pattern is unlikely to be unique to the Netherlands.

For owners and directors, that is not a statistic to skim past. The decision to report or not usually gets made within hours of an attack, under time pressure, with a ransom note still open on screen. Anyone who has no plan for that moment picks the fastest path available, and that is almost never the police.

What the research found

Of the entrepreneurs who actually fell victim to ransomware, 18 percent contacted the police. Of that group, only 26 percent went on to file an official report, the formal process that puts a case on paper. Just 7 percent of the small businesses affected contacted the attackers themselves. The rest solved the problem on their own, with a cybersecurity firm, or simply gave up.

Matthijsse's explanation is a sober one: victims mainly need a fast fix, and the police usually cannot provide that. Investigating a ransomware attack is slow, technically complex, and often international, while a business needs to be running again within days. That sense of helplessness, not unwillingness, is the main reason the real reporting numbers lag so far behind people's stated intentions.

A criminal operation run like any other business

The research also exposes how professionally ransomware is now organised. A small core group builds and maintains the malware, then rents it out to separate attack crews who hand over a cut of whatever they extract. Access to a victim's systems is bought separately from specialised criminal brokers. Larger attacks involve forty to a hundred people in total, each with their own role.

Attackers deliberately target administrator rights, making recovery without their help as difficult as possible. Most victims only notice they have been breached the moment the ransom demand appears. Those who pay usually do get their files back, a kind of customer service criminals build in on purpose to keep the business model working. One of the groups studied claimed six years of operation without a single customer who didn't get their files back.

Why reporting is still worth it

The fact that police can't fix things within a day doesn't mean reporting is pointless. Long-running investigations sometimes do pay off. In a large 2022 attack on storage devices across the Netherlands, police worked with international partners to claw back paid ransoms and obtain decryption keys. Everyone who had reported the attack beforehand got their files back for free. Without that report, that would not have been possible.

Reporting also feeds the bigger picture investigators work from. Projects that combine police, prosecutors, and cybersecurity firms across borders, such as the operation that dismantled much of the Qakbot network earlier this year, run on the reports and technical traces that individual victims supply. An attack that is never registered simply does not count in that effort.

On top of that, reporting to the police is not a substitute for the legal breach notification duty. If personal data was affected, Dutch organisations must separately notify the Autoriteit Persoonsgegevens, the Dutch data protection authority, within 72 hours. The two notifications go to different bodies for different purposes, and skipping one because you already did the other is a common mistake.

What to arrange now

This is best decided before an attack happens, not during one. Write down in advance who you call when things go wrong: your IT partner for technical recovery, and the police for reporting, in that order, without dropping the second step. Keep that contact list somewhere that still works if your company network is down.

Keep backups that are physically or logically separated from your production environment, so an attacker who gains administrator rights cannot encrypt those too. Test restoring from those backups at least once a year, not just making them. And agree within your team who makes the call on paying or not during an incident, so that decision does not fall entirely on whoever happens to see the ransom note first.

If it does happen: report it, even if you do not expect quick results. It is the only channel that can eventually trace the people behind it, and sometimes gets your own files back. Want to get that preparation in order now, from a working backup plan to a clear playbook for when things go wrong? Zarioh helps organisations build the security and response capability that makes that possible. Feel free to get in touch for a no-obligation conversation.