By FAYYADH JAAFAR / Pic by TMR GRAPHIC
79% of Malaysian organisations surveyed were attacked with ransomware in 2021, which is significantly higher than the global average of 66%, according to Sophos’ annual State of Ransomware 2022 survey.
Among the 5,600 mid-sized organisations in 31 countries that participated in the survey, 39% of Malaysian organisations that had data encrypted in an attack paid the ransom, which is a three-fold increase from 2020.
The global average ransom paid by organisations that had data encrypted in their most significant ransomware attack, increased nearly fivefold to reach $812,360, with a three-fold increase in the proportion of organisations paying ransoms of $1 million or more.
According to the survey, the main reasons for the increase in ransomware attacks include the fact that they are easy to deploy and that the attackers can earn a lot of money.
“The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers’ greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure,” said Chester Wisniewski, principal research scientist at Sophos, added that in recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service.
“Many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands. However, the results indicate that cyber insurance is getting tougher and, in the future, ransomware victims may become less willing or less able to pay sky-high ransoms.”
“Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource-intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing, and cybercriminals will continue to go after the low-hanging fruit.”
The findings show that ransom payments are higher; in 2021, 11% of organisations said they paid ransoms of US $1 million or more, up from 4% in 2020, while the percentage of organisations paying less than US $10,000 dropped to 21% from 34% in 2020, marking a shift in the trend of ransomware attacks.
In addition, there are more victims who paid the ransom. In 2021, 46% of organisations that had data encrypted in a ransomware attack paid the ransom. Twenty-six percent of organisations that were able to restore encrypted data using backups in 2021 also paid the ransom.
The average cost of recovering from the most recent ransomware attack in 2021 was US $1.4 million. It took, on average, one month to recover from the damage and disruption. Ninety percent of organisations said the attack had impacted their ability to operate, and 86% of private sector victims said they had lost business and/or revenue because of the attack.
Cyber insurance, which covers the ransom, is the go-to solution for many organisations, with 83% of mid-sized organisations having cyber insurance that covers them in the event of a ransomware attack. In 98% of incidents, the insurer paid some or all of the costs incurred (with 40% overall covering the ransom payment).
Ninety-four percent of those who have cyber insurance reported that their experience in obtaining it has changed in the last year, with increased demands for cybersecurity measures, more complex or expensive policies, and fewer organisations offering insurance protection.
“Alongside the escalating payments, the survey shows that the proportion of victims paying up also continues to increase, even when they may have other options available,” said Wisniewski.
“There could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site. In the aftermath of a ransomware attack, there is often intense pressure to get back up and running as soon as possible. Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option.”
“It’s also an option fraught with risk. Organizations don’t know what the attackers might have done, such as adding backdoors, copying passwords and more. If organisations don’t thoroughly clean up the recovered data, they’ll end up with all that potentially toxic material in their network and be potentially exposed to a repeat attack.”