Ransomware 2020: Costs, Risks, and Realities.

Like all areas of business this year, it’s important for organisations to get up-to-date information about the current state of ongoing cyber threats in the wake of changes due to COVID-19, remote work, and the rapid digital transformation that occurred across multiple industries.

Ransomware is an important one to cover in this respect as many organisations moved to remote working - causing an increased amount of email-based correspondence, the handling more customer data due to increased online transactions, and changes to digital environments.

There isn’t a “one size fits all” fix for ransomware prevention and protection, and many organisations are still unprepared for response and recovery if they do happen to be a victim of this type of malware attack.

Let’s Get Down to the Data:

According to a recent survey of information security providers, ransomware is still the number one malware threat to organisations, with an increasing amount of attacks, and a massively increased cost to businesses due to recovery downtime. The team at Datto surveyed information security providers across North America, Europe, and Asia Pacific.

The full report is available via Datto, and below are some “at a glance” statistics:

The Ransomware Landscape:

1. Ransomware
2. Viruses
3. Adware
4. Spyware
5. Remote access trojans

• 60% of security providers saw a ransomware attack for small to medium businesses in the first half of 2020 alone, with 79% in the Asia Pacific region seeing attacks in the last two years.
• 85% of security providers indicate that businesses should be “very concerned” about ransomware, with only 30% of small businesses actually reporting being “very concerned”.
• 50% of ransomware got through anti-virus/anti-malware solutions - with security providers recommending a multi-layered approach across software, training, processes, and business continuity plans in the case of an attack.

The leading causes of ransomware attacks (respondents could choose more than one response):

1. Phishing Emails (54%)
2. Poor user practices (27%)
3. Lack of cybersecurity training (26%)
4. Weak Passwords/Access Management (21%)

Money Talk - Business Post Ransomware:

Business downtime is the major fallout from a ransomware attack, in most cases costing a business more than the initial ransom. This makes the case for the resiliency and redundancy plan being critical for lowering costs.

• In 2020, the average cost of business downtime exceeded the ransom cost by 50 times, at a rate of $274,200 on average.

The top four consequences from ransomware attacks were reported as being:

1. Loss of business productivity
2. Business-threatening downtime
3. Lost data and/or device
4. Decreased customer profitability

Industries affected:

While no industry is safe from ransomware, due to the pandemic the healthcare industry has been the most targeted throughout 2020. As seen below, finance/insurance, government, professional services, education, technology, and legal services topped the list of other affected industries.

Overall, the report indicates that the risk of ransomware remains significant and that the costs associated with an attack remain steady, but that the business downtime costs are significantly increased. The importance of having a multi-layered "protect and contain" approach across your software, infrastructure, and people is high in order to reduce the risk to your organisation. 

Interested in learning more about how to protect your organisation from ransomware? Speak to one of our business security advisors, or contact us with an enquiry.