To report or not to report: Exploring the motivations and factors associated with reporting of ransomware victimisation among entrepreneurs

Although ransomware attacks are considered to be a prominent cyberthreat for organisations, little is known about reporting by entrepreneurs after ransomware victimisation. The current study uses two surveys to explore reporting behaviour among freelancers and small and medium-sized enterprises in the Netherlands. One survey was conducted among entrepreneurs who were victimised by ransomware (n=189). Another survey was conducted among entrepreneurs who were not victimised by ransomware (n=2,496) and included a vignette experiment. While about 92% of the entrepreneurs in the vignette experiment indicated that they would contact the police, only about 18% of the victims did, citing reasons such as solving it themselves or with the help of another party and the belief that the police will not do anything about it. Reporting to the police and to other organisations was related to the emotional and financial impact, with the exception of reporting to the police by victims. There was no association between a negative affective response and situational factors such as having a back-up and reporting among victims and non-victims. • This study examined reporting of ransomware victimisation among entrepreneurs • Discrepancies exist between (intended) reporting behaviour of victims and non-victims. • There is underreporting of ransomware among victims, particularly to the police. • Reporting to the police and other organisations is related to the emotional and financial impact. • No association between situational factors, negative affective response and reporting.