The latest report by cybersecurity solutions company Sophos found that 72% of state and local government organizations attacked by ransomware had their data encrypted or 7% more than the cross-sector average.

The survey report “The State of Ransomware in State and Local Government 2022” also saw that only 20% of state and local government organizations were able to stop the ransomware attack before data could be encrypted, which is significantly less than the cross-sector average of 31% (8% had their data held for ransom but not encrypted). However, at the same time, the government sector had one of the lowest attack rates with only 58% hit by ransomware in 2021.

“Traditionally, government organizations haven’t been prime targets for ransomware attackers, since they don’t have as much money as traditional businesses, and criminal groups are reticent to attract attention from law enforcement,” said Chester Wisniewski, principal research scientist, Sophos, in a media advisory. “However, when these organizations do get hit, they have little in the way of protection because they don’t have the budget for additional, in-depth cybersecurity support, including threat hunting teams or security operations centers.”

Cybercriminals exploit session cookies to bypass MFA — Sophos
Sophos unveils cloud workload protection updates

In addition to experiencing a high encryption rate, the government sector also experienced a significant drop in the amount of encrypted data recovered after paying the ransom when compared to 2020, or 58% in 2021 as opposed to 70% in 2020; this was also lower than the cross-sector average of 61%.

The report also found that 2021 saw a 70% rise in the number of ransomware attacks against local government organizations with 58% targeted when compared to 34% in 2020. The cost for government organizations to remediate an attack was three times the average ransom the sector paid.

In the light of the survey findings, Sophos experts recommend the following best practices for all organizations across all sectors:

– Install and maintain high-quality defenses across all points in the environment. Review security controls regularly and make sure they continue to meet the organization’s needs
– Proactively hunt for threats to identify and stop adversaries before they can execute attacks — if the team lacks the time or skills to do this in-house, outsource to a Managed Detection and Response (MDR) team
– Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines and open RDP ports, for example. Extended Detection and Response (XDR) solutions are ideal for this purpose
– Prepare for the worst, and have an updated plan in place of a worst-case incident scenario
– Make backups, and practice restoring them to minimize disruption and recovery time