More Than 4 Out of 5 Ransomware Victims Pay Their Hackers
A survey has found that 83% of ransomware victims give into their attackers’ demands, and nearly two out of three organizations were victims in the past year.
Photo via Adobe, by vchalup
The vast majority of ransomware victims end up paying their attackers to get their data unlocked, according to a new report from cybersecurity software provider ThycoticCentrify.
The report, “2021 State of Ransomware Survey and Report: Preventing and Mitigating the Skyrocketing Costs and Impacts of Ransomware Attacks,” based on survey responses from 300 U.S.-based IT professionals, found that an alarming 83% of ransomware victims gave into their attackers’ demands.
The report also revealed that nearly two thirds of companies admitted to being victims of a ransomware attack in the past 12 months.
According to the company’s report, the U.S. has seen an increase in ransomware attacks of nearly 200%, with the average ransom demand now eclipsing $100,000 – ten times what it was just last year.
The report details what we already know: cybercriminals and ransomware gangs are constantly evolving and are getting more sophisticated as attack surfaces increase and hacking tools become more widely available.
“Payouts have become so lucrative that ransomware developers have emerged to sell or establish an affiliate program for their tools and expertise, offering Ransomware-as-a-Service (RaaS),” the report says. “Ransomware could further evolve into a subscription model where you pay the criminal gangs not to target you.”
According to ThycoticCentrify’s report, 72% of organizations increased their cybersecurity budgets after a ransomware attack, which was by far the most frequent action taken by ransomware victims.
Those budgets were increased largely to protect against ransomware, as 93% of respondents said they have allocated funds in their annual security budget specifically to protect against ransomware.
Organizations are mostly spending those funds on network security (49%) and cloud security (41%), but fewer are investing in identity access management (24%), endpoint security (23%) and privileged access management (19%).
“Companies may not realize or be underestimating how important these are to preventing against, mitigating or disrupting ransomware attacks,” ThycoticCentrify said in the report.
The company notes the need to go beyond traditional security measures like antivirus programs to reduce the threat of ransomware, and those more modern approaches include network segmentation, privileged access management, threat detection and adopting a Zero Trust network architecture to limit what end users can access.
In addition to investing in privileged access management and adopting least privilege access policies, the report also urged IT admins to create incident response plans to contain and limit the damage.
The more that ransomware attacks are successful, the more victims will end up paying those ransoms, which continues to fund the ransomware industry.
“While companies are increasing their spending on cyber security solutions to prevent becoming ransomware victims, it is essential they protect all users as if they were privileged users,” the company said. “By safeguarding privileged access with PAM solutions to reduce or eliminate attacker dwell time, as well as implementing a robust incident response plan, organizations can minimize the risk from what appears to be a threat that will only increase for the foreseeable future.”
This article originally ran in CS’ sister publication, MyTechDecisions.com and has been edited. Zachary Comeau is TD’s web editor.
If you appreciated this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!
Related Content
Leading in Turbulent Times: Effective Campus Public Safety Leadership for the 21st Century
This new webcast will discuss how campus public safety leaders can effectively incorporate Clery Act, Title IX, customer service, “helicopter” parents, emergency notification, town-gown relationships, brand management, Greek Life, student recruitment, faculty, and more into their roles and develop the necessary skills to successfully lead their departments. Register today to attend this free webcast!
