Sophos has released the State of Ransomware 2022 report, which surveyed 5600 mid-sized organizations across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East and Africa. The 2022 report shows that 66% of organizations were hit with a ransomware attack in 2021, a 37% increase from 2020. Additional key findings include:
- The average ransom paid by organizations that had data encrypted increased nearly five-fold to $812,360
- 11% of organizations surveyed admitted paying ransoms of over $1M or over in 2021, up 4% from 2020.
- 46% of organizations which had data encrypted in a ransomware attack paid the extortion demand.
- 26% of organizations that were able to restore encrypted data using backups still paid ransom
I think the part of this that bothers me is the fact that the ransom was paid as if enough organizations had prevention methods in place, robust backup strategies and took the stance that they don’t pay the ransom, nobody would bother with ransomware.
I have two comments on this. The first is from Saryu Nayyar, CEO and Founder of Gurucul:
“It’s clear that ransomware is an escalating threat that costs organizations worldwide dearly. It’s not just the cost of paying the ransom, which is a staggering $1M or more. It’s also the cost of business disruption or loss, and the time required to restore data and operations. Almost half of all organizations paid the extortion demands if their data was encrypted. The lesson is clear: you will end up paying for ransomware one way or the other. Either you’ll pay cyber criminals to get your data back, or you’ll pay for protection. It is infinitely better and less costly to implement security controls to detect and stop malware payloads, including ransomware. True machine learning powered behavior analytics is a proven cyber defense that will prevent ransomware from getting ahold of your data and your business. Exact revenge by strengthening your defenses.”
Chris Olson, CEO of The Media Trust adds to this:
“The frequency and cost of ransomware attacks have been rising steadily for years in a row, but 2020 saw an acceleration in this trend which has continued until now. Although concerning, it isn’t surprising – from the COVID pandemic to international conflict and the continued growth of darknet markets, multiple factors have exacerbated the incidence of malicious cyberactivity.”
“Above all, organizations have largely neglected digital surfaces like Web and mobile apps which are increasingly used by cyber actors to target their employees. At the Media Trust, we have observed an alarming rise in digital attacks based on polymorphic and obfuscated code, rapid URL shifting and other advanced techniques to deliver ransomware, phishing attacks, and more.”
Ransomware isn’t going away anytime soon. Thus organizations need to take action on multiple fronts to protect themselves. And if the worst happens, they should make the option of paying the ransom a non-starter. The sooner that happens, the better off we will all be.
Like this:
Like Loading...
Related
This entry was posted on April 27, 2022 at 2:26 pm and is filed under Commentary with tags Sophos. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
State of Ransomware 2022 Report Released By Sophos
Sophos has released the State of Ransomware 2022 report, which surveyed 5600 mid-sized organizations across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East and Africa. The 2022 report shows that 66% of organizations were hit with a ransomware attack in 2021, a 37% increase from 2020. Additional key findings include:
I think the part of this that bothers me is the fact that the ransom was paid as if enough organizations had prevention methods in place, robust backup strategies and took the stance that they don’t pay the ransom, nobody would bother with ransomware.
I have two comments on this. The first is from Saryu Nayyar, CEO and Founder of Gurucul:
“It’s clear that ransomware is an escalating threat that costs organizations worldwide dearly. It’s not just the cost of paying the ransom, which is a staggering $1M or more. It’s also the cost of business disruption or loss, and the time required to restore data and operations. Almost half of all organizations paid the extortion demands if their data was encrypted. The lesson is clear: you will end up paying for ransomware one way or the other. Either you’ll pay cyber criminals to get your data back, or you’ll pay for protection. It is infinitely better and less costly to implement security controls to detect and stop malware payloads, including ransomware. True machine learning powered behavior analytics is a proven cyber defense that will prevent ransomware from getting ahold of your data and your business. Exact revenge by strengthening your defenses.”
Chris Olson, CEO of The Media Trust adds to this:
“The frequency and cost of ransomware attacks have been rising steadily for years in a row, but 2020 saw an acceleration in this trend which has continued until now. Although concerning, it isn’t surprising – from the COVID pandemic to international conflict and the continued growth of darknet markets, multiple factors have exacerbated the incidence of malicious cyberactivity.”
“Above all, organizations have largely neglected digital surfaces like Web and mobile apps which are increasingly used by cyber actors to target their employees. At the Media Trust, we have observed an alarming rise in digital attacks based on polymorphic and obfuscated code, rapid URL shifting and other advanced techniques to deliver ransomware, phishing attacks, and more.”
Ransomware isn’t going away anytime soon. Thus organizations need to take action on multiple fronts to protect themselves. And if the worst happens, they should make the option of paying the ransom a non-starter. The sooner that happens, the better off we will all be.
Share this:
Like this:
Related
This entry was posted on April 27, 2022 at 2:26 pm and is filed under Commentary with tags Sophos. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.