---
title: "One More Reason to Avoid a Ransomware Attack | DuoCircle"
description: "Imagine your company just fell victim to a ransomware attack. What would you do? One group of doctors decided to retire rather than pay the ransom."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/"
---

Quick Answer

Ransomware recovery firms that publicly advise victims not to pay often pay the ransom themselves and add their fee on top. A ProPublica investigation found that Proven Data, which marketed 'latest technology' decryption, was actually obtaining decryption tools by paying attackers, per company emails and an FBI affidavit. SC Magazine reported MonsterCloud charged $2,500 for analysis and up to $25,000 to recover from an attack where the ransom itself was $7,000 in bitcoin. Real-world ransom payments cited: Jackson County, Georgia paid $400,000, the city of Chicago paid more than $1 million, and one medical group retired rather than pay. The post's argument is straightforward: prevention via cloud-based phishing protection is a fraction of either the ransom or the recovery firm's fee.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=One%20More%20Reason%20to%20Avoid%20a%20Ransomware%20Attack&url=undefined%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F&title=One%20More%20Reason%20to%20Avoid%20a%20Ransomware%20Attack "Share on Reddit") [ ](mailto:?subject=One%20More%20Reason%20to%20Avoid%20a%20Ransomware%20Attack&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F "Share via Email") 

![Ransomware Attack](https://media.mailhop.org/duocircle/images/2019/05/spf-record-2786.jpg) 

Imagine your company just fell victim to a **ransomware attack**. What would you do? One group of doctors decided to retire rather than pay the ransom. The officials in [Jackson County, Georgia decided to pay](/phishing-protection/phishing-prevention-technology-why-arent-municipalities-onboard/#more-13746) the $400,000 ransom. The city of Chicago paid more than $1 million. So, what would you do?

One of the things you might consider doing, rather than pay the ransom, is to hire a ransomware recovery firm. _These companies ostensibly use high-tech methods to restore the affected data with techniques like data decryption_.

When you visit their websites, you’ll see quotes like “Paying attackers is definitely not a solution.” Or, “Don’t Pay the Ransom. Paying criminals a ransom doesn’t guarantee you’ll get your data back. Paying-up is a risk you don’t want to take. Let our experts handle the situation for you.” Sounds good, right? As things turn out, the truth is very different.

[![Recent Report](https://media.mailhop.org/duocircle/images/2019/05/what-is-DKIM-3698.jpg)](https://media.mailhop.org/duocircle/images/2019/05/what-is-DKIM-3698.jpg)

A [recent report](https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/) from investigative newsroom ProPublica found that these companies almost always do exactly what they tell you not to do: pay the ransom. So now, not only are you paying the ransom, but these companies’ fees on top of it.

According to the report, one such company “Proven Data promised to help ransomware victims by unlocking their data with the ‘latest technology,’ according to company emails and former clients. Instead, it obtained decryption tools from cyberattackers by paying ransoms, according to Storfer and an FBI affidavit obtained by ProPublica.”

If you do get hit by a ransomware attack and decide the best course of action is to pay the ransom, there are companies out there that openly help you in that process, so you know what you’re dealing with up front. But, there’s still something much better than that. _Not getting stung by ransomware in the first place._

It’s shocking how many companies out there won’t spend 50 bucks a month for advanced [phishing protection](/email/phishing-protection) but will come up with all kinds of money to waste on these recovery firms. According to an [article on SC Magazine](https://www.scmagazine.com/home/security-news/ransomware/companies-often-call-in-firms-that-offer-high-tech-ransomware-solutions-in-these-situations-but-some-of-these-companies-simply-pay-off-the-attackers/?utm%5Fsource=newsletter&utm%5Fmedium=email&utm%5Fcampaign=SCUS%5FNewswire%5F20190520&hmSubId=01xQvtS0ero1&email%5Fhash=0da939dab246e8101d6090def505f6f5&mpweb=1325-7949-1896988), “MonsterCloud was mentioned in a case of paying attackers after the firm requested $2,500 for an analysis of the problem and costing up to $25,000 to recover from an attack where the ransom was only $7,000 worth of bitcoin.”

[![cloud-based email security](https://media.mailhop.org/duocircle/images/2019/05/what-is-DKIM-8723.jpg)](https://media.mailhop.org/duocircle/images/2019/05/what-is-DKIM-8723.jpg)

When you’re ready to take advantage of low-cost, quick-deployed, real-time, [cloud-based email security](/) to protect your company from phishing and ransomware, head on over to Duocircle and try it risk-free for 30 days.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F) [ ](https://twitter.com/intent/tweet?text=One%20More%20Reason%20to%20Avoid%20a%20Ransomware%20Attack&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fone-more-reason-to-avoid-a-ransomware-attack%2F) Copy 

Related Articles

- [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg)  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)
- [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg)  10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)
- [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg)  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)
- [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg)  7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"One More Reason to Avoid a Ransomware Attack","description":"Imagine your company just fell victim to a ransomware attack. What would you do? One group of doctors decided to retire rather than pay the ransom.","url":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/","datePublished":"2019-05-21T15:22:03.000Z","dateModified":"2025-05-22T17:32:58.000Z","dateCreated":"2019-05-21T15:22:03.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/"},"articleSection":"phishing-protection","keywords":"","wordCount":410,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/05/spf-record-2786.jpg","caption":"Ransomware Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"One More Reason to Avoid a Ransomware Attack","item":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"One More Reason to Avoid a Ransomware Attack","item":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"One More Reason to Avoid a Ransomware Attack","description":"Imagine your company just fell victim to a ransomware attack. What would you do? One group of doctors decided to retire rather than pay the ransom.","url":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/","datePublished":"2019-05-21T15:22:03.000Z","dateModified":"2025-05-22T17:32:58.000Z","dateCreated":"2019-05-21T15:22:03.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/one-more-reason-to-avoid-a-ransomware-attack/"},"articleSection":"phishing-protection","keywords":"","wordCount":410,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/05/spf-record-2786.jpg","caption":"Ransomware Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```