Reporting ransomware victimization: explaining citizens’ willingness to report to the police and other organizations

Although ransomware is considered one of the biggest online threats today, little is known about citizens’ reporting behavior and their willingness to report such incidents. Insight into victimization is further complicated by the fact that attacks are reported to different organizations. Therefore, this study examines the association between the willingness to report ransomware victimization to the police and other organizations, alongside possible explanatory factors, such as offense characteristics, victim characteristics and motivations for (not) reporting to the police. Using a vignette experiment ( n = 3,404), respondents were shown a hypothetical ransomware attack varying in ransom amount, threat of data leakage, backup availability, and external advice to pay. Results show that a significant number of respondents would report the attack, highlighting a discrepancy with actual reporting rates in the Netherlands. The findings show that a higher ransom amount, the threat of leaking confidential data, and advice to pay the ransom significantly increase the willingness to report, suggesting that perceived severity and external support influence the intention to report. Furthermore, the study shows that women, older individuals, individuals with higher education, individuals with an average income and individuals living with parents or guardians are more likely to report. Moreover, it reveals that perceived vulnerability is a strong predictor of reporting behavior and that a strong sense of justice and community responsibility are significant drivers for reporting ransomware to the police. However, doubts about police effectiveness, and a preference for alternative solutions prevent Dutch citizens from reporting ransomware to the police.