Published: June 22, 2022 on our newsletter Security Fraud News & Alerts Newsletter.
A report by Mimecast, The State of Email Security, takes a look at ransomware threats against businesses in 2020 and the cost of these attacks beyond paying the ransom demand. The report finds 61% of organizations fell victim to ransomware in 2020. That translates to 6 out of 10 businesses being attacked last year. That’s an increase of 10% over the previous year as reported by Sophos. Not only are the number of ransomware attacks increasing, but the costs associated with them are growing as well.
It’s widely agreed that circumstances beyond our control, like the coronavirus, helped create the historic level of hacking last year. As a result of the pandemic, quick adjustments to employees working from home led to unsecured systems, helping give bad actors a cornucopia of hacks to choose from. As Mimecast’s report finds, many of those hackers turned to ransomware as their malware of choice. The report also finds email threats, including those carrying ransomware are up 64% since last year.
Costs Beyond Paying the Ransom
The FBI strongly advises any enterprise not to pay a ransom demand as it only encourages further attacks. However, situations like the recent attack against Colonial Pipeline that stopped oil and gasoline from reaching the South and East Coast of the U.S. led to the company paying the $5 million ransom. The company made the decision to pay, something the FBI deems a cringe-worthy and detrimental response. They eventually got their encrypted data back and the juices flowing again and the FBI was able to retrieve over half of the payment through an investigation. However, most ransomware victims are not that lucky.
The Mimecast report finds 52% of ransomware victims paid the ransom, however only 66% recovered their data, and 37% lost their data entirely even though they paid the ransom demand. Beyond paying the ransom, companies lose revenue from downtime, remediation costs, restoring the encrypted data, and damage to their reputations. Mimecast reports companies lost an average of six working days to downtime, and 37% say their downtime lasted more than one week. The economy also indirectly pays for ransomware attacks and losses range from $57 billion to $109 billion annually according to a report by Third Way.
Potential for Ransomware Legislation
Earlier this year, a public-private task force created recommendations for a whole-of-government approach to ransomware threats that was presented to the White House. In it, they created a framework requiring both government and business create a united response to deter these attacks in order to disrupt the ransomware business. That could mean paying a ransom demand is illegal, while also making businesses better equipped for these attacks and how best to respond to them. There’s no better time than now for enterprise to boost their security and regularly backup their data to an offline system. Remember to keep backups out of the reach of hackers by keeping it out of internet access.
Summing it all up, a threat analyst from Emsisoft says “Prohibiting ransomware payments is the quickest and most effective way to end ransomware attacks…Attacks happen for one reason and one reason only: They are profitable. If you make them unprofitable, the attacks will stop.”
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com