I'm beginning to think we should ban ransom payments to criminals—or at least disallow insurance from covering them. I know that sounds extreme, but hear me out.

Ransomware attacks have changed as they have become more notorious. Some might think that because the typical target is no longer individuals, but rather larger organizations, they are personally safe. The truth is actually that the risks have gone up for both individuals and organizations.

Before, an individual would know if their data had been taken ransom. Today, it is more likely that data they've entrusted to a third party (often entrusted to yet another third party) is being taken, leaked, or sold. The individual may not be aware of the situation until the organization notifies them, always long after the fact. Usually organizations announce incidents only when obligated to. As a result, individuals face just as much risk, but without the knowledge or agency to protect themselves.