POSTER: How Attackers Determine the Ransom in Ransomware Attacks Tom Meurs University of Twente Enschede, Netherlands t.w.a.meurs@utwente.nl Marianne Junger University of Twente Enschede, Netherlands m.junger@utwente.nl Abhishta Abhishta University of Twente Enschede, Netherlands s.abhishta@utwente.nl Erik Tews University of Twente Enschede, Netherlands e.tews@utwente.nl Abstract—Ransomware may lead to massive economic dam- age to victims [13]. However, it is still unclear how at- tackers determine the amount of ransom. In this poster we empirically study the ransom requested by attackers in ransomware attacks. We analysed 371 ransomware attacks reported to the Dutch Police between 2019 and 2021. Our results indicate that attacker’s effort and opportunity are important predictors for the ransom requested. The goal of the poster is to invite other researchers for collaboration. Index Terms—Ransomware, cyber attacks, criminal revenue, police reports 1. Introduction Ransomware attacks have become more prevalent over the past years [1]. Even though most ransomware attackers are financially motivated [9], the actual financial gains made by attackers are still unclear. This poster abstract aims at introducing a dataset that could be used to empir- ically study the ransom requested by attackers. The Rational Choice Perspective (RCP) [2], [3] states that criminal decision-making is based on weighing the costs and benefits of an attack. Costs could be effort or risk of being caught by Law Enforcement. Benefits is mostly money, but could also be reputation. Based on RCP, we hypothesise that ransom requested depends on how much effort attackers put in a ransomware attack. Furthermore, there might be an increase of requested ransom over the years because improved anti-virus scanners might make it more difficult to perform ransomware attacks and there- fore require more effort. A complementary approach is the Routine Activity Theory (RAT) [10]. RAT focuses on the opportunities for attackers provided by context. From RAT it follows that victims with more money provide the opportunity for attackers to earn more money and therefore will demand higher ransom [6]. Furthermore, opportunity might vary between seasons [12], so requested ransom could also vary between seasons. Summarizing, attacker’s effort and opportunity could influence ransom requested (Figure 1) .We propose the following hypotheses: • H1: If attackers put in more effort they will ask a larger ransom • H2: There is an increasing trend of requested ransom over the years • H3: High revenue of victims should lead to larger requested ransom • H4: The requested ransom varies over the different seasons Figure 1: Theoretical framework 2. Methods 2.1. Sample We investigated 371 ransomware attacks registered by the Dutch Police between 2019 and 2021. Ransomware attacks on individuals as companies were included in the sample. Ransomware attacks with victims outside the Netherlands, but reported to the Dutch Police, were excluded from this study. 2.2. Measures To measure requested ransom information about the ransom at first contact with victims was collected. From the 371 observations, 172 attacks (46 %) reported ransom demanded by attackers. If ransom demanded was un- known, this was mostly (52 %) because attackers wanted victims to contact them to inform them about the ransom and the victim did not want to do so. In our analysis we perform analysis to see if there is selection bias of the unknown requested ransomware.