A vast majority of businesses that pay the demand following a ransomware (opens in new tab) attack don’t end up retrieving their encrypted and stolen data, a new report has claimed.
In its “State of data security by Rubrik Zero Labs: The hard truths of data security” report, based on a poll of more than 1,600 IT and security leaders (including CISOs and CIOs), the company found just 16% of global organizations that paid a ransom and received a decryptor actually managed to recover all of their data.
To make matters worse, almost three-quarters (72%) of organizations reported paying their ransomware demand.
Risking a lot
Together with phishing and business email compromise (BEC) attacks, ransomware is considered one of the most popular and destructive forms of cyberattack today.
In ransomware attacks, a threat actor first steals, then encrypts, all of the sensitive data found across company endpoints. Then, it demands a payment be made in cryptocurrency (usually Monero, a type of cryptocurrency that’s very hard to trace), in exchange for the decryptor. The threat actor usually also threatens to release the stolen data on the dark web, unless its demands are met. That way, it looks to force the victim into making the payment even if the company has an up-to-date backup.
Backups seem to be a popular countermeasure to ransomware. Almost all (99%) of eternal organizations reported having backup and recovery technology. However, 93% reported encountering “significant issues” with their solutions. Furthermore, nine out of ten reported malicious actors attempting to impact data backups during a cyberattack, and 73% were at least partially successful in doing so.
Cybersecurity experts and law enforcement agencies have warned against paying the ransom demand, for multiple reasons. Meeting the demand doesn’t guarantee the return of the file, nor does it guarantee the same attackers won’t strike the company again in a month. It also doesn’t guarantee security from other threat actors. At the same time, it motivates the cybercriminals to continue targeting businesses with ransomware, and even funds future cybercriminal campaigns.
