Business. Scoop » ANZ Companies Paying Ransoms Because They Don’t Believe In Their Backups
Press Release – Commvault Businesses cannot always control whether they become a target. They can, however, control how prepared they are when disruption inevitably arrives. More than a decade after. . .
Press Release – CommvaultBusinesses cannot always control whether they become a target. They can, however, control how prepared they are when disruption inevitably arrives. More than a decade after ransomware emerged as one of the biggest cyber threats facing organisations, one statistic remains surprisingly stubborn: many businesses are still choosing to pay. New research from Commvault’sState of Data Resilience ANZ 2026report found that one in three organisations across Australia and New Zealand that experienced a ransomware attack paid the ransom demand. Even more concerning, more than one-third of those that paid never successfully regained access to their data or were subjected to additional extortion demands. For business leaders, the findings highlight an uncomfortable truth. Paying a ransom is often viewed as the quickest path back to operations, yet it offers little certainty. In many cases, it simply exchanges one business risk for another. The challenge isn’t simply about cyber security. Increasingly, it is about operational resilience. Organisations today depend on an expanding ecosystem of cloud applications, AI-enabled platforms, connected infrastructure and distributed workforces. Every new system creates another dependency, making it harder to understand which technology truly keeps the organisation running when disruption occurs. Many organisations have invested heavily in preventative security technologies. Firewalls, endpoint detection, identity management and security operations centres all play an important role in reducing risk. But prevention alone is no longer enough. Even mature organisations now operate on the assumption that an attack will eventually occur. The real differentiator is what happens next. Business continuity has traditionally focused on keeping critical services operating during unexpected events. Cyber resilience extends that thinking by asking a more difficult question: if systems become unavailable tomorrow, what must be restored first to keep the organisation functioning?This is where many organisations continue to struggle. Commvault’s research found that while a majority of organisations have identified their most critical business functions, fewer have mapped the technology, applications and data needed to support them during an incident. That gap creates uncertainty at precisely the moment when clarity matters most. Without confidence in recovery plans or the integrity of backup data, executives often find themselves making high-pressure decisions with incomplete information. The decision to pay a ransom is frequently less about negotiation with criminals than it is about uncertainty over whether internal recovery capabilities will actually work. That uncertainty carries significant costs. Downtime impacts customers, staff productivity, supply chains and organisational reputation. For sectors such as healthcare, financial services, government and critical infrastructure, prolonged outages can quickly become matters of public confidence rather than simply IT issues. As organisations continue adopting artificial intelligence, these challenges are becoming more complex. AI relies on vast amounts of organisational data spread across multiple environments. As data volumes grow, recovery becomes more difficult unless organisations clearly understand which datasets and systems are genuinely business critical. Rather than aiming to recover everything simultaneously, leading organisations are beginning to focus on identifying what some describe as their “Minimum Viable Company”—the people, systems, applications and data that must be operational for the organisation to continue delivering essential services. This approach changes resilience planning from an IT exercise into a business strategy. It also requires regular testing. Recovery plans that exist only on paper provide little reassurance during an actual incident. Organisations need confidence that backups are complete, recovery processes function as intended, and critical systems can be restored within acceptable timeframes. The latest research suggests that organisations able to answer those questions before an attack occurs are significantly better positioned to recover without relying on cyber criminals. As ransomware continues to evolve, resilience is increasingly becoming a competitive advantage. Businesses cannot always control whether they become a target. They can, however, control how prepared they are when disruption inevitably arrives. For organisations across New Zealand, the message is becoming increasingly clear: the most valuable investment is not simply preventing attacks, but ensuring the business can continue operating when prevention fails. Content Sourced fromscoop. co. nzOriginal url