{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T07:41:38Z","timestamp":1764229298139,"version":"3.46.0"},"reference-count":37,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2025,9,10]],"date-time":"2025-09-10T00:00:00Z","timestamp":1757462400000},"content-version":"vor","delay-in-days":252,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,1,17]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>To understand what is more valuable, availability or confidentiality of the data on a private computer, we conducted an online survey experiment with over 800 German participants assigned to one of the two scenarios: ransomware demanding payment for availability versus for confidentiality of their data. Half of the participants was recruited at the platform Clickworker, and another half was recruited at various German universities. We find that 43.7% of respondents would pay for availability, whereas 38.6% would pay for confidentiality, this difference being not statistically significant and independent of the sample. The median of non-zero payments for Availability is 50 EUR in both samples, whereas for Confidentiality, Clickworkers were willing to pay median 30 EUR, and the University sample median 100 EUR. The probability of paying for young and elderly people is higher than for middle-aged ones, whereas sex, marital status and having children has no influence. Good backup quality and low income predict refusal to pay for availability, but not for confidentiality. In both scenarios, belief that the offenders will keep their promise and feeling scared predict payment, whereas belief that the payment is immoral and feeling strong negative emotions predict refusal to pay. Once the person decided to pay, the high emotional value of their files, as well as high social media usage predict higher payment value.<\/jats:p>","DOI":"10.1093\/cybsec\/tyaf022","type":"journal-article","created":{"date-parts":[[2025,8,9]],"date-time":"2025-08-09T11:39:34Z","timestamp":1754739574000},"source":"Crossref","is-referenced-by-count":0,"title":["Valuation of confidentiality and availability in a personal ransomware attack scenario"],"prefix":"10.1093","volume":"11","author":[{"given":"Freya","family":"Gassmann","sequence":"first","affiliation":[{"name":"Rheinland-Pf\u00e4lzische Technische Universit\u00e4t Kaiserslautern-Landau Department of Social Sciences, , Erwin-Schroedinger-Stra\u00dfe, 67653 Kaiserslautern ,","place":["Germany"]}]},{"given":"Janina","family":"Beck","sequence":"additional","affiliation":[{"name":"The Boston Consulting Group , Ludwigstra\u00dfe 21, 80539 Munich ,","place":["Germany"]}]},{"given":"Nora","family":"Gourmelon","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg Department of Computer Science, , Martensstr. 3, 91058 Erlangen ,","place":["Germany"]}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7158-0219","authenticated-orcid":false,"given":"Zinaida","family":"Benenson","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg Department of Computer Science, , Martensstr. 3, 91058 Erlangen ,","place":["Germany"]}]}],"member":"286","published-online":{"date-parts":[[2025,9,10]]},"reference":[{"article-title":"Joint cybersecurity advisory: 2021 trends show increased globalized threat of ransomware","year":"2021","author":"CISA, FBI, NSA, International Partners","key":"2025112702395805300_bib1"},{"article-title":"Cybercrime 2021 (in German)","year":"2021","author":"German Federal Office of Criminal Investigation","key":"2025112702395805300_bib2"},{"article-title":"The Scourge of Ransomware: Victim insights on harms to individuals, organisations and society","year":"2024","author":"MacColl","key":"2025112702395805300_bib3"},{"article-title":"2023 Internet Crime Report","year":"2023","author":"Internet Crime Complaint Center (IC3)","key":"2025112702395805300_bib4"},{"issue":"1","key":"2025112702395805300_bib5","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1109\/TDSC.2004.2","article-title":"Basic concepts and taxonomy of dependable and secure computing","volume":"1","author":"Avizienis","year":"2004","journal-title":"IEEE T Depend Secure Comput"},{"key":"2025112702395805300_bib6","first-page":"109","article-title":"Privacy in ubiquitous computing","volume-title":"Ubiquitous computing fundamentals","author":"Langheinrich","year":"2018"},{"issue":"4","key":"2025112702395805300_bib7","doi-asserted-by":"crossref","first-page":"989","DOI":"10.2307\/41409970","article-title":"Information privacy research: an interdisciplinary review","volume":"35","author":"Smith","year":"2011","journal-title":"MIS Quart"},{"key":"2025112702395805300_bib8","doi-asserted-by":"crossref","DOI":"10.24251\/HICSS.2018.474","article-title":"Putting a price tag on personal information-a literature review","volume-title":"Proceedings of the 51st Hawaii International Conference on System Sciences","author":"Wagner","year":"2018"},{"issue":"3","key":"2025112702395805300_bib9","doi-asserted-by":"crossref","first-page":"190023","DOI":"10.1098\/rsos.190023","article-title":"An economic analysis of ransomware and its welfare consequences","volume":"7","author":"Hernandez-Castro","year":"2020","journal-title":"Roy Soc open sci"},{"key":"2025112702395805300_bib10","article-title":"The value of data: Estimating the value individuals put on access to their computer files","volume-title":"WEIS","author":"Cartwright","year":"2021"},{"key":"2025112702395805300_bib11","article-title":"An investigation of individual willingness to pay ransomware","volume":"30","author":"Cartwright","year":"2022","journal-title":"J Financial Crime"},{"key":"2025112702395805300_bib12","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1145\/2488388.2488406","article-title":"Your browsing behavior for a big mac: Economics of personal information online","volume-title":"Proceedings of the 22nd international conference on World Wide Web","author":"Carrascal","year":"2013"},{"issue":"2","key":"2025112702395805300_bib13","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1086\/671754","article-title":"What is privacy worth?","volume":"42","author":"Acquisti","year":"2013","journal-title":"J Legal Stud"},{"key":"2025112702395805300_bib14","article-title":"When 25 cents is too much: An experiment on willingness-to-sell and willingness-to-protect personal information","volume-title":"WEIS","author":"Grossklags","year":"2007"},{"issue":"3","key":"2025112702395805300_bib15","doi-asserted-by":"crossref","first-page":"425","DOI":"10.1007\/s10603-019-09419-y","article-title":"How much is data privacy worth? a preliminary investigation","volume":"42","author":"Winegar","year":"2019","journal-title":"J Consum Policy"},{"key":"2025112702395805300_bib16","doi-asserted-by":"crossref","first-page":"254","DOI":"10.1287\/isre.1090.0260","article-title":"The effect of online privacy information on purchasing behavior: an experimental study","volume":"22","author":"Tsai","year":"2011","journal-title":"Inform Syst Res"},{"issue":"1","key":"2025112702395805300_bib17","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1057\/jit.2016.4","article-title":"Towards a value theory for personal data","volume":"32","author":"Spiekermann","year":"2017","journal-title":"J Inform Technol"},{"key":"2025112702395805300_bib18","article-title":"On the value of information - what facebook users are willing to pay","volume-title":"European Conference on Information Systems (ECIS 2012)","author":"Bauer","year":"2012"},{"key":"2025112702395805300_bib19","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.2148886","article-title":"Psychology of ownership and asset defense: Why people value their personal information beyond privacy","volume-title":"International Conference on Information Systems (ICIS 2012)","author":"Spiekermann","year":"2012"},{"key":"2025112702395805300_bib20","first-page":"129","article-title":"Cryptovirology: Extortion-based security threats and countermeasures","volume-title":"IEEE Symposium on Security and Privacy","author":"Young","year":"1996"},{"issue":"7","key":"2025112702395805300_bib21","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1145\/3097347","article-title":"Cryptovirology: The birth, neglect, and explosion of ransomware","volume":"60","author":"Young","year":"2017","journal-title":"Commun ACM"},{"article-title":"Demographics of Cybercrime Report","year":"2021","author":"Malwarebytes","key":"2025112702395805300_bib22"},{"article-title":"The State of Consumer Home Cybersecurity 2021","year":"2021","author":"Sophos","key":"2025112702395805300_bib23"},{"key":"2025112702395805300_bib24","first-page":"155","article-title":"\u201di was told to buy a software or lose my computer. i ignored it\u201d: a study of ransomware","volume-title":"15th symposium on usable privacy and security (SOUPS 2019)","author":"Simoiu","year":"2019"},{"key":"2025112702395805300_bib25","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1145\/3481357.3481508","article-title":"Replicating a study of ransomware in Germany","volume-title":"European Symposium on Usable Security 2021","author":"Ortloff","year":"2021"},{"article-title":"Ransomware: How consumers and businesses value their data. IBM X-Force Research","year":"2016","author":"Kessem","key":"2025112702395805300_bib26"},{"article-title":"Ransom-Aware","year":"2017","author":"Black Carbon","key":"2025112702395805300_bib27"},{"key":"2025112702395805300_bib28","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.3544951","article-title":"Estimating the value of computer files using willingness to pay and willingness to accept","author":"Cartwright","year":"2020"},{"key":"2025112702395805300_bib29","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/eCrime57793.2022.10142138","article-title":"Ransomware: How attacker\u2019s effort, victim characteristics and context influence ransom requested, payment and financial loss","volume-title":"APWG Symposium on Electronic Crime Research (eCrime)","author":"Meurs","year":"2022"},{"key":"2025112702395805300_bib30","doi-asserted-by":"crossref","DOI":"10.1109\/eCrime61234.2023.10485506","article-title":"Ransomware economics: a two-step approach to model ransom paid","volume-title":"APWG Symposium on Electronic Crime Research (eCrime)","author":"Meurs","year":"2023"},{"article-title":"Exploring the psychological mechanisms used in ransomware splash screens","year":"2007","author":"Hadlington","key":"2025112702395805300_bib31"},{"key":"2025112702395805300_bib32","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.2937641","article-title":"Economic analysis of ransomware","author":"Hernandez-Castro","year":"2017"},{"article-title":"Deutsche version der positive and negative affect schedule PANAS (gesis panel)","year":"2016","author":"Breyer","key":"2025112702395805300_bib33"},{"issue":"6","key":"2025112702395805300_bib34","doi-asserted-by":"crossref","first-page":"1063","DOI":"10.1037\/0022-3514.54.6.1063","article-title":"Development and validation of brief measures of positive and negative affect: the PANAS scales","volume":"54","author":"Watson","year":"1988","journal-title":"J Pers Soc Psychol"},{"key":"2025112702395805300_bib35","doi-asserted-by":"crossref","first-page":"2202","DOI":"10.1145\/3025453.3025926","article-title":"Self-confidence trumps knowledge: A cross-cultural study of security behavior","volume-title":"Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems","author":"Sawaya","year":"2017"},{"key":"2025112702395805300_bib36","doi-asserted-by":"crossref","first-page":"429","DOI":"10.1109\/SP40000.2020.00021","article-title":"Security update labels: establishing economic incentives for security patching of iot consumer products","volume-title":"2020 IEEE Symposium on Security and Privacy (SP)","author":"Morgner","year":"2020"},{"key":"2025112702395805300_bib37","volume-title":"Statistical power analysis for the behavioral sciences","author":"Cohen","year":"1988","edition":"2nd edn."}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/11\/1\/tyaf022\/64235721\/tyaf022.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/11\/1\/tyaf022\/64235721\/tyaf022.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T07:40:05Z","timestamp":1764229205000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyaf022\/8250540"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":37,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1,17]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyaf022","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"type":"print","value":"2057-2085"},{"type":"electronic","value":"2057-2093"}],"subject":[],"published-other":{"date-parts":[[2025]]},"published":{"date-parts":[[2025]]},"article-number":"tyaf022"}}