Content:
Ransomware attacks aim to compromise critical data, extort vast sums of money, and damage brand reputation. In the three decades since the first confirmed attack, ransomware has gone from simple extortion aimed at hundreds (with symbolic payouts) to a $20 billion global enterprise devastating municipalities and SMB with reckless disregard for the capital costs inflicted.
While some costs are intangible (like a loss of organizational trust or soured relationships) others such as ransoms paid, market share loss, or businesses that cease operations can be pointed to as clear signs that the threat is real. Below, we will define the economic, and intangible costs of ransomware attacks and understand why some sectors are more vulnerable to attack.
Which industries are most affected by Ransomware?
Ransomware attacks historically have been equal-opportunity offenders. They take advantage of poorly trained staff and ineffectively onboarded, or not updated technical solutions to hijack data and impart enormous economic costs across a broad range of industries and sectors.
Recent research by CISO Magazine indicates that Healthcare, Retail, IT & education have become a major focal point of global ransomware attacks. CISO Magazine indicates that Healthcare, Retail, IT & education have become a major focal point of global ransomware attacks.
What are these sectors vulnerable to ransomware attacks?
From inadequate cyber training for employees, lack of resources for consistent IT reviews as well as a general lack of preparedness there are more than enough options to rationalize the reasons why various sectors are under attack.
- Cyber Education
You are only as strong as your weakest link and this is especially true for cyber defense. With nearly 90% of data breaches caused by human error, the need to empower employees with the skills to be able to overcome cyber threats is life or death. By emphasizing a clear and regular course of cyber education and skills-building activities, organizations can build a network of cyber-aware individuals, ready to mitigate social engineering and avoidable cyber risks.
- Investing in IT
While it might seem simple, investing in an IT staff and the technical solutions they need to protect your organization is critical to decreasing your attack surface. By hiring a qualified team of IT professionals who have the resources to apply patches, implement new technology, and train your team on industry best practices the risks of a cyber-attack decrease dramatically.
- Prioritizing a Proactive Approach to Cyber
Cybersecurity is not like a t-shirt that you replace every day, thrown to the ground when its use is fulfilled. Rather, cyber awareness is a mentality that must permeate the culture of an organization from the top down. By focusing on a cyber-first approach to risk management at every level of the organization, team members and policy directives are informed by the active threats that impact data loss and cyber protection.
What are the Costs?
The sheer costs of ransomware attacks are growing so much year to year, that the stats are hard to fathom. According to a report from Cybersecurity Ventures in 2017 ransomware damages were reported to cost nearly $5 billion, a 15-fold increase from 2015. This is a mere pittance to what the following years would showcase.
In 2018, costs associated with ransomware attacks had reached $8 billion, and by 2021, $20 billion. This represents 57 times the costs of just 6 years before.
On an individual level, the costs of a ransomware attack can be enough to put you out of business. Recent research by Palo Alto Networks suggests that ransomware payouts alone have climbed from a modest $115,123 in 2019 to nearly $312,493 in 2020, a 171% year-over-year increase. With the costs so high, it’s of no surprise that 60% of SMB cease operations within 6 months of a significant data breach.
These numbers are based mostly on extortion/ransom costs and the price of technological implementation. What they fail to take into account is the potential future implication of the attack, beyond the dollars and cents. While the immediate rush to regain system access and reassure customers those systems that will return to operation can rationalize paying ransoms, the long-term risk of data exfiltration has increasingly come to the forefront.
In Q2 of 2021 Data exfiltration rose 20 percent. In practice, nearly 70 percent of ransomware attacks now involve a legitimate risk of data exfiltrated by the ransomware leaked at a later date. Exfiltration has increased 43 percent from Q1 of 2021 and all signs indicate the trend is here to stay.
Key takeaways
Ransomware attacks are captivating the news cycle and crippling the bottom lines of businesses worldwide. As current trends stand, the scale and scope of devastation will be elevating to biblical proportions.
- The costs of ransomware attacks have increased 57X from 2015-2021
- Individual ransomware payouts have increased 171% from 2020-2021 to an average of $312,493
- Healthcare, Retail, IT & education have become major focal points of global ransomware attacks.
- The sectors most at risk to attack, lack clear IT governance, proactive employee education programs, and often lack the resources to prioritize cybersecurity.
Author: Yehudah Sunshine, Chief Evangelist & Head of PR, odix
