It can be too easy to look at ransomware as a business problem. After all, it attacks businesses, locking down their data for ransom, often selling it or spreading it, and sometimes altering it for the business if returning it at all. It can be too easy to overlook another impacted target in all the mess.

What happens to the people whose data a business has collected and uses?

The Impact of Ransomware Doesn’t End at the Business

While we in no way wish to undermine ransomware's direct impacts on organizations of all sizes, it is important to contextualize ransomware as a societal problem at this point. 

One only has to look back a few years to see how a few businesses being impacted had ripple effects that caused real and serious disruption to ordinary, completely unaffiliated peoples’ lives. 

• In 2021, ransomware attacks on Colonial Pipeline and JBS meat processing led to panics about shortages.
• Attacks on school systems, healthcare providers, transportation, government services... ultimately harm those who rely on them. 
• Most data leaks involve consumer information. In fact, research by IBM revealed that customer PII was the most commonly breached record type from 2021 to 2023.
• Ransomware doesn’t just lock down data until a ransom is paid. It steals data, sells it, and shares it, all while locking it down for the attacked business. 

This is What is Known as a Second-Order Harm

A security think tank based in the UK called Royal United Services Institute released a paper at the beginning of this year that studied different “orders” of harms, based on how removed they were from the attack.

1. First-Order Harms impacted the business that was attacked and its direct staff.
2. Second-Order Harms impacted organizations downstream from the attacked business as well as the individuals who relied on or trusted the attacked business.
3. Third-Order Harms impacted entire societies, organizations, and governments through all the ransomware incidents the collective experienced on an economic and security-based level.

As you can imagine, the entire paper is fascinating. Here, however, we wanted to focus primarily on the second order’s individuals.

Ransomware Causes Significant Second-Order Harms

Depending on the type of organization you run, if you were to be shut down by ransomware, there are assorted second-order harms that could result. As the paper says, 

“Given the digital dependencies of most businesses and service providers in modern economies and societies, individuals have significant exposure to ransomware harms.”

Naturally, those staying in hospitals or receiving medical treatment are obvious second-order victims. Still, the paper also cites how social housing was negatively impacted by such attacks, causing the residents to suffer from the loss of needed basic care. However, the paper also describes financial harms, as happens when personal information and financial records are leaked—often an effect of ransomware attacks.

However, the most impactful is possibly the third harm: psychological.

Again, the lack of healthcare and government services will cause distress, but so will the real risk of double extortion.

Put yourself in the shoes of one of your customers for a moment. How would you feel if your identity was stolen because you trusted a business? Would you ever want to work with that business again? 

What if you ran a business that had to close because a trusted vendor was attacked, and all of the vendor's data on your business was stolen? What would you tell your customers, “Sorry, but we put our trust in the wrong business, so now we all have to pay for it?”

Obviously, if you ever had the opportunity, you’d never want to work with that business again, right?

We’ll Protect You (and By Extension, Your Customers) from Ransomware

Ransomware is no simple beast to overcome, as countless attacks have proven, but we will do everything possible to make your business more resilient. It will take your whole team's full commitment and buy-in, but if anyone resists, have them read this blog and maybe even that paper we linked to above.

Reach out to us to learn more about how we can help protect your business from ransomware and, as a result, make all of your customers and partners that much safer, too. Call us at (410) 531-6727 today.