Several Indian companies compromised by the WannaCry cyber-attack were unwilling to pay in bitcoins to recover their data, fearing that using the unregulated virtual currency to settle the ransom would only invite more trouble.
There’s also the matter of the three-day deadline for the ransom to be paid from the time a computer is infected. For companies not already transacting in bitcoins, that’s too short a deadline.
“Fourteen clients have reached out to me in the last three-and-half days and none of them are ready to pay up in bitcoins for the ransomware attack,” said Manan Shah, chief executive of cyber-security provider Avalance Global Solutions. “They do not feel a bitcoin is a legitimate mode of payment.”
The bitcoin digital crypto-currency is not yet a part of the mainstream banking system. In India, it is neither legal or illegal to trade in bitcoins and it continues to be a grey area.
Cybersecurity experts estimate that the WannaCry ransomware has infected tens of thousands of computers in India, affecting the operations of companies across industries, including banking, insurance, manufacturing, business process outsourcing and retail.
Cyber-criminals on Friday unleashed a vicious attack globally, encrypting files stored within computers and demanding $300 or $600 in bitcoins to unlock or restore the documents. The attackers have threatened to double the ransom if it is not paid in three days and that the data would be lost forever after seven days.
With the clock ticking, Indian companies were in two minds about paying in bitcoins to recover their data. Time is also a factor. “To buy a bitcoin in India, most (bitcoin) wallets need PAN and other KYC details to authenticate an account,” said Shree Parthasarathy, partner at Deloitte, adding that it would take about 48 hours to load a bitcoin wallet through startups such as Zebpay, Coinsecure, and Unocoin.
“Companies are responding in primarily three ways. Few companies have adopted a wait-and-watch approach, hoping that their data will be restored. A few companies have paid the ransom and are waiting for their data to get unlocked. The most risk-intelligent enterprises are restoring data from their offline backups. They may face data loss but only minimal,” Parthasarathy said.
Cybersecurity companies have advised affected clients not to pay the ransom since there is no guarantee that the data would be restored.
A 2016 Fortinet report on ransomware states that one in four organisations that
paid ransom lost their money and never recovered their data.
“We have seen no price movement or no surge in demand (for bitcoins),” said Saurabh Agrawal, cofounder of bitcoin wallet provider Zebpay. The attackers have so far received 57 bitcoins as ransom from their victims globally, which translates to about Rs 65 lakh ($100,000).
On average, 1,000 bitcoins are traded in Indian bitcoin exchanges daily. That’s about Rs 5 crore in volume, as compared with Rs 7,000 crore worth of transactions a day globally.
With the rise of bitcoin startups in India, the government is considering ways to regulate the currency and has set up a committee to study the
circulation of crypto-currencies in the country.
Though bitcoin startups have denied any increase in activity, an employee with one of these firms said there had indeed been a rise in bitcoin transactions. “Since bitcoin is unregulated, it is seen among the masses as a taboo to buy and sell bitcoin,” this person said, declining to be identified. “Because it is seen as a taboo, and there is no clarity whether buying or selling of bitcoins is legal, there is no overt publicity of this fact.”