The latest “State of Ransomware 2022” report by cybersecurity firm Sophos shows that 66% of organizations surveyed were hit with ransomware in 2021, up from 37% in 2020.

The average ransom paid by organizations that had data encrypted in their most significant ransomware attack increased nearly fivefold to reach $812,360, with a threefold increase in the proportion of organizations paying a ransom of $1 million or more or 4% more in 2020. the percentage of organizations paying less than $10,000 dropped to 21% from 34% in 2020.

Forty-six percent (46%) of the organizations that had data encrypted paid the ransom to get their data back, even if they had other means of data recovery, such as backups.

Sophos unveils cloud workload protection updates
Sophos launches new solution to strengthen connectivity at access layer

The report summarizes the impact of ransomware on 5,600 mid-sized organizations in 31 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East, and Africa, with 965 sharing details of ransomware payments.

“In the aftermath of a ransomware attack, there is often intense pressure to get back up and running as soon as possible,” said Chester Wisniewski, principal research scientist at Sophos. “Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option.”

Cost of cyberattacks

But Wisniewski emphasized the risk of paying a ransom. Organizations remain clueless as to what extent of damage to their system, Attackers might have added backdoors or copied passwords, among others.

“If organizations don’t thoroughly clean up the recovered data, they’ll end up with all that potentially toxic material in their network and potentially exposed to a repeat attack,” he said.

The average cost to recover from the most recent ransomware attack in 2021 was $1.4 million. It took on average one month to recover from the damage and disruption. Ninety percent of organizations said the attack had impacted their ability to operate, and 86% of private sector victims said they had lost business and/or revenue because of the attack.

“The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers’ greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure,” said Wisniewski.

Cyber insurance

Many organizations rely on cyber insurance to help them recover from a ransomware attack with 83% of mid-sized organizations had cyber insurance that covers them in the event of a ransomware attack, and in 98% of incidents, the insurer paid some or all the costs incurred (with 40% overall covering the ransom payment).

Sophos recommends the following best practices to help defend against ransomware and related cyberattacks

• Install and maintain high-quality defenses across all points in the organization’s environment. Review security controls regularly and make sure they continue to meet the organization’s needs.
• Proactively hunt for threats to identify and stop adversaries before they can execute their attack. If the team lacks the time or skills to do this in-house, outsource to a Managed Detection and Response (MDR) specialist.
• Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines, open RDP ports, etc. Extended Detection and Response (XDR) solutions are ideal for this purpose.
• Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated.
• Make backups, and practice restoring from them so that the organization can get back up and running as soon as possible, with minimum disruption.