Nearly one-third of ransomware victims are hit multiple times, even after paying hackers
Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
More than three-in-ten ransomware victims are being hit multiple times, thanks to ineffective defenses and security fragmentation.
According to Barracuda Networks' Ransomware Insights Report, 57% of organizations fell victim to a successful ransomware attack in the last 12 months, with 31% of victims affected more than once.
A ransom was paid in 32% of cases, rising to 37% among organizations affected twice or more. More than two-in-ten said they'd experienced pressure to make payments through threats to partners, shareholders, and customers, and 16% reported threats to employees.
However, 41% of those who paid a ransom failed to recover all their data, the study noted. Decryption tools provided by the attackers don't always work, or only a partial key may be provided.
Meanwhile, files can be damaged during the encryption and decryption processes - or, sometimes, the ransom is paid but decryption tools aren't supplied.
Many ransomware victims lack basic security, with only 47% using an email security solution, for example, compared with 59% of non-victims. More than seven-in-ten organizations that suffered an email breach were also hit with ransomware.
“The findings make it clear that ransomware is an escalating threat, and fragmented security defenses leave organizations immensely vulnerable,” said Neal Bradbury, chief product officer at Barracuda.
“Too many victims are juggling an unmanageable number of disconnected tools, often introduced with the best intentions to strengthen protection. Tools that can’t work together, or which are not configured correctly, create security gaps and lead to breaches."
Just under a quarter of the ransomware incidents reported involved data encryption, while 27% saw the attackers stealing and publishing data. Hackers infected devices with other malicious payloads in 29% of cases, and installed backdoors for persistence in 21%.
Ransomware attacks are getting worse
The impact of a successful ransomware attack is also growing. Around four-in-ten victims said they'd suffered from reputational harm, with a quarter reporting tangible business impact and a similar number saying they'd lost new business opportunities.
Similarly, around a quarter of the ransomware incidents reported involved the encryption of data, locking endpoints and data theft.
Attacks also featured lateral movement across the network, the infection of multiple endpoints, the installation of additional malicious payloads, privilege elevation, and embedding backdoors and other persistence mechanisms.
To make it harder for victims to restore their data without paying, around one in five attackers accessed and wiped backups and deleted shadow copies of files.
“In many cases attackers can move through victims’ networks, gaining access to devices, data and more without being detected and blocked," said Bradbury.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- 75% of UK business leaders are willing to risk criminal penalties to pay ransoms
- The ransomware boom shows no signs of letting up
- The ransomware groups worrying security researchers in 2025
-
The NCSC wants to build an AI-powered 'Cyber Shield' to protect the UK from hackersNews The aim is to create a national, sovereign defence capability to protect government agencies and critical infrastructure
-
IBM targets data center efficiency gains with new z17 and LinuxONE offeringsNews Cost, data center footprint, and performance improvements are coming for IBM Z and LinuxONE customers
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
