Ransomware attacks soar in a year, data shows

Cybersecurity company Sophos surveyed more than 5,000 mid-sized businesses in 31 countries

More organisations are being hit with ransomware attacks as the average ransom paid increased nearly fivefold.

Cybersecurity company Sophos says it is becoming "increasingly easy for cybercriminals to deploy ransomware", with data showing more businesses are becoming affected.

The company surveyed more than 5,000 mid-sized businesses in 31 countries as part of its State of Ransomware report 2022.

They found 66 per cent of businesses surveyed were hit with ransomware in 2021, up from 37 per cent in 2020.

The average ransom paid by organisations that had data encrypted in their most significant ransomware attack also increased nearly fivefold to $812,360.

A total of 46 per cent of the organisations that had data encrypted paid the ransom to get their data back, even if they had other means of data recovery, such as backups.

"Alongside the escalating payments, the survey shows that the proportion of victims paying up also continues to increase, even when they may have other options available," said Chester Wisniewski, principal research scientist at Sophos.

"There could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site. In the aftermath of a ransomware attack there is often intense pressure to get back up and running as soon as possible.

"Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option. It's also an option fraught with risk.

"Organisations don't know what the attackers might have done, such as adding backdoors, copying passwords and more. If organizations don't thoroughly clean up the recovered data, they'll end up with all that potentially toxic material in their network and potentially exposed to a repeat attack."

Sophos says the average cost to recover from the most recent ransomware attack in 2021 was $1.4m, with it on average taking one month to recover from the damage and disruption.

Some 90 per cent of organisations said the attack had impacted their ability to operate, and 86 per cent of private sector victims said they had lost business and/or revenue because of the attack.

Sophos also found that while most mid-sized businesses had cyber insurance, the majority said that their experience of getting it has changed over the last 12 months.

Reasons for this included higher demands for cybersecurity measures, more complex or expensive policies and fewer organisations offering insurance protection.

"The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers' greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure," said Wisniewski.

"In recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service. Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands.

"However, the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky high ransoms. Sadly, this is unlikely to reduce the overall risk of a ransomware attack.

"Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit."