[BreachExchange] State of Ransomware shows huge growth in threat and impacts

[Matthew Wheeler]

https://www.continuitycentral.com/index.php/news/technology/7275-state-of-ransomware-shows-huge-growth-in-threat-and-impacts

Sophos has released its annual survey and review of real-world ransomware
experiences in its ‘State of Ransomware 2022’ report. This shows that 66
percent of organizations surveyed were hit with ransomware in 2021, up from
37 percent in 2020.

The average ransom paid by organizations that had data encrypted in their
most significant ransomware attack, increased nearly fivefold to reach
$812,360, with a threefold increase in the proportion of organizations
paying ransoms of $1 million or more. 46 percent of the organizations that
had data encrypted paid the ransom to get their data back, even if they had
other means of data recovery, such as backups.

The report summarizes the impact of ransomware on 5,600 mid-sized
organizations in 31 countries across Europe, the Americas, Asia-Pacific and
Central Asia, the Middle East, and Africa, with 965 sharing details of
ransomware payments.

“Alongside the escalating payments, the survey shows that the proportion of
victims paying up also continues to increase, even when they may have other
options available,” said Chester Wisniewski, principal research scientist
at Sophos. “There could be several reasons for this, including incomplete
backups or the desire to prevent stolen data from appearing on a public
leak site. In the aftermath of a ransomware attack there is often intense
pressure to get back up and running as soon as possible. Restoring
encrypted data using backups can be a difficult and time-consuming process,
so it can be tempting to think that paying a ransom for a decryption key is
a faster option. It’s also an option fraught with risk. Organizations don’t
know what the attackers might have done, such as adding backdoors, copying
passwords and more. If organizations don’t thoroughly clean up the
recovered data, they’ll end up with all that potentially toxic material in
their network and potentially exposed to a repeat attack.”

Key findings include:

Ransom payments are higher – In 2021, 11 percent of organizations said they
paid ransoms of $1 million or more, up from 4 percent in 2020, while the
percentage of organizations paying less than $10,000 dropped to 21 percent
from 34 percent in 2020.

More victims are paying the ransom – In 2021, 46 percent of organizations
that had data encrypted in a ransomware attack paid the ransom. 26 percent
of organizations that were able to restore encrypted data using backups in
2021 also paid the ransom.

The impact of a ransomware attack can be immense – the average cost to
recover from the most recent ransomware attack in 2021 was $1.4 million. It
took on average one month to recover from the damage and disruption. 90
percent of organizations said the attack had impacted their ability to
operate, and 86 percent of private sector victims said they had lost
business and/or revenue because of the attack.

Many organizations rely on cyber insurance to help them recover from a
ransomware attack – 83 percent of mid-sized organizations had cyber
insurance that covers them in the event of a ransomware attack – and, in 98
percent of incidents, the insurer paid some or all the costs incurred (with
40 percent overall covering the ransom payment).

94 percent of those with cyber insurance said that their experience of
getting it has changed over the last 12 months, with higher demands for
cyber security measures, more complex or expensive policies and fewer
organizations offering insurance protection.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20220504/1e543f2b/attachment.html>