WannaCry only demanded Attack.Ransom $ 300 from each victim . These hackers extorted Attack.Ransom $ 1 million from one South Korean company . Hackers appear to have pulled off Attack.Ransom a $ 1 million heist with ransomware in South Korea . The ransomware attacked Attack.Ransom more than 153 Linux servers that South Korean web provider Nayana hosted , locking up more than 3,400 websites on June 10 . In Nayana 's first announcement a few days later , it said the hackers demanded Attack.Ransom 550 bitcoins to free up all the servers -- about $ 1.62 million . Four days later , Nayana said it 'd negotiated with the attackers and got the payment reduced Attack.Ransom to 397 bitcoins , or about $ 1 million . This is the single largest-known payout for a ransomware attack Attack.Ransom , and it was an attack Attack.Ransom on one company . For comparison , the WannaCry ransomware attacked Attack.Ransom 200,000 computers across 150 countries , and has only pooled $ 127,142 in bitcoins since it surfaced . Ransomware demands Attack.Ransom have risen rapidly over the past year , tripling in price from 2015 to 2016 . But even then , the highest cost of a single ransomware attack Attack.Ransom was $ 28,730 . Nayana agreed to pay Attack.Ransom the ransomware in three installments , and said Saturday it 's already paid Attack.Ransom two-thirds of the $ 1 million demand Attack.Ransom . `` It is very frustrating and difficult , but I am really doing my best and I will do my best to make sure all servers are normalized , '' a Nayana administrator said , according to a Google translation of the blog post . The company is expected to make the final payment Attack.Ransom once all the servers from the first and second payouts Attack.Ransom have been restored . Trend Micro , a cybersecurity research firm , identified the ransomware as Erebus , which targets Linux servers for attacks . It first surfaced in September through web ads , and popped up again in February . `` It 's worth noting that this ransomware is limited in terms of coverage , and is , in fact , heavily concentrated in South Korea , '' Trend Micro researchers said Monday in a blog post . Paying ransomware Attack.Ransom is at the victim 's discretion , but nearly all organizations , including government agencies and security researchers , advise against it .

Ransomware has largely been an opportunistic , rather than a targeted , form of cybercrime with the goal of infecting as many users as possible . That model has worked so effectively that extortion is now ubiquitous when it comes to cybercrime — so much so that even fake attacks are proving to be successful . As I wrote earlier this month , the surge of extortion attacks Attack.Ransom impacting organizations has led to a number of fake extortion threats , including empty ransomware demands Attack.Ransom where actors contact organizations , lie about the organization ’ s data being encrypted , and ask for money Attack.Ransom to remove the non-existent threat . Cybercriminals like to follow the path of least resistance , and an attack doesn ’ t get much easier than simply pretending to have done something malicious . However , attacks Attack.Ransom over the past year have proven that infecting organizations with ransomware can result in much higher payouts Attack.Ransom . The more disruptive the attack , the more money some organizations are willing to pay to make the problem go away . As a result , ransomware actors are shifting their targets towards more disruptive attacks , which we examine in our latest report , Ransomware Actors Shift Gears : New Wave of Ransomware Attacks Attack.Ransom Aims to Lock Business Services , Not Just Data . It was just 13 months ago that Hollywood Presbyterian Medical Center made national attention by paying Attack.Ransom $ 17,000 to decrypt its files after a ransomware attack Attack.Ransom . The incident was novel at the time , but those types of stories have since become commonplace . Organizations need to take action to protect themselves against ransomware actors that are trying to find more effective ways to disrupt business operations and demand even higher ransom payouts Attack.Ransom .