Cybereason Ransomware True Cost to Business Study reveals organizations pay multiple ransom demands
Cybereason, the XDR company, has published the results of their second annual ransomware study during a year of unprecedented attacks to better understand the true impact on businesses. This global study reveals that 73 percent of organizations suffered at least one ransomware attack in 2022, compared with just 55 percent in the 2021 study. The study once again finds that ‘it doesn’t pay-to-play a ransom demand, as 80 percent of organizations that paid were hit by ransomware a second time, with 68 percent saying the second attack came in less than a month and 67% reporting that threat actors demanded a higher ransom amount.
The report, titled Ransomware: The True Cost to Business Study 2022, further revealed that of the organizations who opted to pay a ransom demand in order to regain access to their encrypted systems, 54 percent reported that some or all of the data was corrupted during the recovery process, compared to 46 percent in 2021, an increase of 17 percent year-over-year. These findings underscore why it does not pay to pay ransomware attackers, and that organizations should focus on detection and prevention strategies to end ransomware attacks at the earliest stages before critical systems and data are put in jeopardy.
“Ransomware attacks are traumatic events, and when ransomware gangs attack a second, third or fourth time in a matter of weeks, it can bring an organization to its collective knees. Deploying effective anti-ransomware solutions is easier said than done, and the hackers know it. After being hit the first time by a ransomware attack, organizations need time to assess their security posture, determine what are the right tools to deploy, and then find the budget to pay for it. The ransomware gangs know this and it is the biggest reason they strike again quickly,’ said Lior Div, Cybereason CEO and Co-founder.
Key findings in the research include:
--A Weak Supply Chain Leads to Ransomware Attacks: Nearly two-thirds (64 percent) of companies believe the ransomware gang got into their network via one of their suppliers or business partners.
--Senior Leadership Attrition: 35 percent of companies suffered C-level resignations following a ransomware attack.
--A Matter of Life and Death: Nearly 30 percent of companies said they paid a ransom because of the risk to human life due to system downtime.
--Ransom Demands Increase with Each Attack: Nearly 70 percent of companies paid a higher ransom demand the second time.
--Ransomware Attacks Lead to Business Disruptions: Nearly one-third (31 percent) of businesses were forced to temporarily or permanently suspend operations following a ransomware attack.
--Layoffs Result from Ransomware Attacks: Nearly 40 percent of organizations laid off staff as a result of the attack.
--Organizations Don’t Have the Right Tools: 60 percent of organizations admitted that ransomware gangs were in their network up to6 months before they discovered them. This points to the double extortion model where attackers first steal sensitive data then threaten to make it public if the ransom demand is not paid.
The full report can be found here: Ransomware: The True Cost to Business Study 2022
Cybereason is dedicated to teaming with defenders to end ransomware attacks on the endpoint, across the enterprise to everywhere the battle is taking place. Learn more about ransomware defense here or schedule a demo today to learn how your organization can benefit from an operation-centric approach to security.
Survey Methodology The research was conducted by Censuswide in April of 2022 on behalf of Cybereason. 1,456 cybersecurity professionals took part in the survey—with participants from the United States, United Kingdom, Japan, Germany, France, Italy, South Africa, United Arab Emirates, and Singapore. Major industry verticals covered in the research including: Financial Services, Government, Retail, Manufacturing, Healthcare and Legal.
About Cybereason
Cybereason is the XDR company, partnering with Defenders to end attacks at the endpoint, in the cloud and across the entire enterprise ecosystem. Only the AI-driven Cybereason Defense Platform provides planetary-scale data ingestion, operation-centric MalOp™ detection, and predictive response that is undefeated against modern ransomware and advanced attack techniques. Cybereason is a privately held international company headquartered in Boston with customers in more than 40 countries.
