Four in five ransomware victims suffer repeat attacks
Lightning often strikes twice, says Cybereason research
Four in every five organizations that pay ransomware fees suffer another attack, according to research released today by security company Cybereason.
The company published the figure in a report that surveyed cyber security professionals worldwide, with 24% of them based in the US. It found that 46% of the companies targeted a second time were attacked by the same criminals that infected them the first time.
A rise in double extortion attacks — ransomware attacks that encrypt files and steal data — is likely to spur repeat attacks from ransomware groups and their affiliates who want to extract more money from victims.
According to the report, DarkSide, the gang that successfully attacked Colonial Pipeline, had been pressuring its targets with threats to release insider information to stock traders so they could short company shares.
Cyber criminals seem to be good at honoring ransom payments by providing decryption keys, but they aren't great at quality assurance. While 51% of companies that paid a ransom said they retrieved their data in full. Another 46% said they got their data back, but some of it was corrupted. Only 3% didn't get their data back at all.
Ransomware attacks also had a devastating effect on businesses. The study revealed that two-thirds of organizations suffered significant revenue losses, and 29% laid off some staff in the wake of an attack, which often led to the business’s demise. In the US, 31% of companies suffering a ransomware attack closed altogether.
RELATED RESOURCE
Defend your organisation from evolving ransomware attacks
Learn what it takes to reduce risk and strengthen operational resiliency
Senior executives weren’t immune from the effects of successful ransomware attacks. The report found that a third of companies lost senior leadership after an attack, either by dismissal or resignation.
The research found businesses relied heavily on cyber insurance to cover the losses, as 54% of companies took out a policy. However, this often isn't an effective hedge against ransomware risk. Of companies with cyber insurance and suffered an attack, 42% said cyber insurance only partially covered the losses.
-
Curing the cloud hangover: why organizations are rethinking public cloudDiscover why IT leaders are stepping away from a "one-size-fits-all" public cloud approach, embracing cost predictability, and using private cloud to secure enterprise AI data
-
Amazon targets agent safety gains with investment in team behind Lean programming languageNews The tech giant hopes support for the open source programming language could drive AI agent safety improvements
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
