Ransomware attacks are becoming more widespread, more devastating to businesses, and are happening all-to-often. The total cost of ransomware increased by 243% from 2020 to 2021 alone, with the current annual sum of ransomware attack damage being up to $20 billion.
According to Sophos, average ransom demands in 2020 were $108,000 for small businesses (those with < 1,000 employees) and $225,000 for large business (those with 1,000 – 5,000 employees. The average ransom paid by mid-sized organizations was $170,404. Additionally, the typical costs of rectifying a ransomware attack were double the ransom itself. The average bill for ransomware attack recovery reached $1.85 million, which includes downtime, people time, device cost, network cost, lost opportunity, and the ransom paid.
Increasingly, ransomware demands are being tailored to each victim. Attackers adjust their demands to reflect their victims’ ability to pay, and the effort needed to breach their security. Larger enterprises are more likely to be hit by ransomware than smaller ones, and are left to recover from higher ransom demands as well as more sophisticated attacks. Smaller businesses face more basic attacks with lower ransom demands and more generic tactics. There are also attack disparities across country lines, with victims in developed economies facing higher demands. Across the U.S., Canada, the U.K., Germany, and Australia the average ransom is 26% higher than the global average, reaching $214,096.
On top of the gargantuan problem that is ransomware attacks tails another that worsens them: cyber insurance claims are being denied. In the first half of 2020, 41% of cyber-insurance claims were related to ransomware attacks. As ransomware attacks have become more common, insurers have imposed limits or stopped covering ransomware altogether.
In the U.S.73% of insurers have begun declining more applications for cyber coverage. Virtually all insurers are reducing coverage for high-risk sectors, auditing applicants’ security when they apply, lowering total coverage limits, and capping ransom payouts, making the journey to ransomware recovery long, difficult, and oftentimes, unsuccessful.
Legislative initiatives are also working against ransomware attack recovery. Regulatory changes will increase costs to businesses that fail to prevent an attack. In the European Union, GDPR imposes fines on businesses that fail to protect consumer data. In the United States, California’s CCPA (California Consumer Privacy Act) allows consumers to sue businesses after a breach — without having to prove the breach caused harm. In 2020, the United States Treasury began prosecuting those who facilitate ransomware payments made to sanctioned individuals and jurisdictions. Worldwide, law enforcement agencies discourage ransomware payments — believing giving in to demands will encourage more attacks (though still, paying ransoms is not illegal). Businesses are left to recuperate on their own as they lack conducive laws or insurance plans to aid them.
Now more than ever, it’s crucial to take the necessary precautions to safeguard your assets and data. To invest in cybersecurity is to invest in the security of your business and a trajectory of success. Today’s ransomware attacks deploy much more than just hefty ransoms, putting whole corporations at stake. Protect your business from ransomware to ensure that you aren’t.
