Los Angeles Valley College was the victim of a ransomware hacking attack that took down the campus’s website and email system on New Year’s Day until the school paid $28,000 to free hostage data.

1,900 students and faculty were locked out of their computers with the message: “You have 7 days to send us the BitCoin after 7 days we will remove your private keys and it’s impossible to recover your files,” according to the campus newspaper.

It took the college 72 hours of computer systems freezing up throughout the Valley Glen campus before college administrators caved and made the payment the day after school had reopened. But even after the criminals delivered a decryption “key” to unlock LAVC servers, it will take weeks to unlock every campus computer and try to assess damages.

After social media reports began circulating about the details of the administration’s response, Los Angeles Community College District Chancellor Francisco C. Rodriguez, issued a statement on January 6, quoted by the Los Angeles Daily News:

“In consultation with district and college leadership, outside cybersecurity experts and law enforcement, a payment of $28,000 was made by the District …. It was the assessment of our outside cybersecurity experts that making a payment would offer an extremely high probability of restoring access to the affected systems, while failure to pay would virtually guarantee that data would be lost.”

The Global Risks 2015 report, published last January by the World Economic Forum (WEF), warned: “90 percent of companies worldwide recognize they are insufficiently prepared to protect themselves against [cyber attacks].”

WEF lamented that a significant portion of cyber-crime goes undetected, particularly industrial espionage where access to confidential documents and data is difficult to spot. Those crimes would move the needle on the cyber-crime numbers much higher.

Cyber-attacks usually fall into two broad categories: breaches in data security, and sabotage. Personal data, intellectual property, trade secrets, research and information relating to bids, mergers and prices are tempting targets for cyber thieves. Sabotage usually take the form of denial of service attacks, which flood web services with bogus messages, as well as efforts to disable systems and infrastructure.

The law firm of White & Case warns that in addition to commercial losses and public relations problems, disruption of operations and the possibility of extortion, cyber attacks may also expose an organization to regulatory action, negligence claims, inability to meet contractual obligations, and a damaging loss of trust among customers and suppliers.

British insurance company Lloyd’s has estimated that global cyber-crime costs, which includes direct damage plus post-attack disruption to the normal course of business, at $400 billion in 2015. Lloyd’s forecast that about 3,000 companies in the United States had systems compromised by cyber-criminals, cost had quadrupled since 2013.

Juniper Networks expects that due to the rapid digitization of consumers’ lives and enterprise records, criminal cyber-crime global costs will have quadrupled again to about $2.1 trillion by 2019. Only about 60 percent of companies and large organizations believe they can retrieve all their own data from backup files in the event of a ransomware attack.