In the last year, ransomware payments witnessed 500 per cent rise as the menace remains.
Security solutions firm, Sophos, which revealed this in its yearly “State of Ransomware 2024” survey report, said organisations that paid the ransom reported an average payment of $2 million, up from $400,000 in 2023.
However, the report said ransoms are just one part of the cost. Excluding ransoms, the survey found the average cost of recovery reached $2.73 million, an increase of almost $1 million since the $1.82 million that Sophos reported in 2023.
Despite the soaring ransoms, this year’s survey indicated a slight reduction in the rate of ransomware attacks with 59 per cent of organisations being hit, compared with 66 per cent in 2023.
While the propensity to be hit by ransomware increases with revenue, even the smallest organisations (less than $10 million in revenue) are still regularly targeted, with just under half (47 per cent) hit by ransomware in the last year.
The 2024 report also found that 63 per cent of ransom demands were for $1 million or more, with 30 per cent of demands for over $5 million, suggesting ransomware operators are seeking huge payoffs.
Unfortunately, these increased ransom amounts are not just for the highest-revenue organisations surveyed. Nearly half (46 per cent) of organisations with revenue of less $50 million received a seven-figure ransom demand in the last year.
Field CTO, Sophos, John Shier, said: “We must not let the slight dip in attack rates give us a sense of complacency. Ransomware attacks are still the most dominant threat today and are fueling the cybercrime economy. Without ransomware we would not see the same variety and volume of precursor threats and services that feed into these attacks. The skyrocketing costs of ransomware attacks belie the fact that this is an equal-opportunity crime. The ransomware landscape offers something for every cybercriminal, regardless of skill. While some groups are focused on multi-million-dollar ransoms, others settle for lower sums by making it up in volume.”
The report noted that for the second year running, exploited vulnerabilities were the most identified root cause of an attack, impacting 32 per cent of organizations. This was closely followed by compromised credentials (29 per cent) and malicious email (23 per cent).
This is directly in line with recent, in-the-field incident response findings from Sophos’ most recent Active Adversary report.
Victims, where the attack started with exploited vulnerabilities, reported the most severe impact on their organisation, with a higher rate of backup compromise (75 per cent), data encryption (67 per cent) and the propensity to pay the ransom (71 per cent) than when attacks started with compromised credentials.
The surveyed organisations also had a considerably greater financial and operational impact, with the average recovery cost sitting at $3.58 million compared with $2.58 million when an attack started with compromised credentials and a greater proportion of attacked organisations taking more than a month to recover.
Other notable findings from the report include that less than one quarter (24 per cent) of those who pay the ransom hand over the amount originally requested, and 44 per cent of respondents reported paying less than the original demand.
The average ransom payment came in at 94 per cent of the initial ransom demand. In more than four-fifths (82 per cent) of cases funding for the ransom came from multiple sources. Overall, 40 per cent of total ransom funding came from the organisations themselves and 23 per cent from insurance providers.
According to the report, 94 per cent of organisations hit by ransomware in the past year said that the cybercriminals attempted to compromise their backups during the attack, rising to 99 per cent in both state and local governments. In 57 per cent of instances, backup compromise attempts were successful.
In 32 per cent of incidents where data was encrypted, data was also stolen – a slight lift from last year’s 30 per cent – increasing attackers’ ability to extort money from their victims.
“Managing risk is at the core of what we do as defenders. The two most common root causes of ransomware attacks, exploited vulnerabilities and compromised credentials, are preventable, yet still plague too many organisations. Businesses need to critically assess their levels of exposure to these root causes and address them immediately. In a defensive environment where resources are scarce, it’s time organizations impose costs on the attackers, as well. Only by raising the bar on what’s required to breach networks can organizations hope to maximize their defensive spend,” Shier added.
Sophos recommended the following best practices to help organisations defend against ransomware and other cyberattacks to
understand the risk profile, with tools such as Sophos Managed Risk, which can assess an organization’s external attack surface, prioritize the riskiest exposures and provide tailored remediation guidance.
Implement endpoint protection that is designed to stop a range of evergreen and constantly changing ransomware techniques, such as Sophos Intercept X.
Organisations can bolster their defenses with round-the-clock threat detection, investigation and response, either through an in-house team or with the support of a Managed Detection and Response (MDR) provider.
Build and maintain an incident response plan, as well as make regular back-ups and practising recovering data from backups.
