A new report released by online security company Sophos indicates that victims of ransomware attacks have a greater chance of suffering additional attacks within the subsequent 12 months.
The report states that the healthcare sector is at the highest risk of experiencing multiple ransomware attacks.
in the process of putting the report together – “The State of Endpoint Security Today” – the research firm Vanson Bourne questioned 2,700 IT managers in groups of 100 to 5,000 users across the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa. The outcomes that the survey showed make difficult reading:
- 54% of the surveyed companies suffered one or more ransomware attacks in the 12 months.
- Of the groups that were affected by ransomware attacks, there was an average of two attacks experienced per group.
- The average financial impact per targeted organization added up to to $133,000 (including ransom paid, downtime, rectification expenses, etc.).
- The financial cost for the top 3% of companies experiencing a ransomware attack ranged from $6.6 million to $13.3 million.
- The healthcare sector was the main focus of ransomware attacks (76% of respondents), energy was second (65%), professional services were third (59%), and retail (58%) fourth.
- 77% of attacked groups were operating with up-to-date endpoint security at the time of the attack occurring, however 54% of groups have not adapted specific anti-ransomware measures.
Regardless of the fact that they are among the top investor in online security, healthcare groups are more often hit by ransomware attacks. The compilers of the report feel this is because healthcare is thought of as a soft target by cybercriminals due to having an old IT infrastructure and limited resources for enhancing IT security. Healthcare groups are also believed to be more likely to meet ransom demands.
This would suggest that healthcare organizations are investing their IT budgets on the incorrect style of security defenses, and the results of the survey appear to reaffirm that belief. 60% of those questioned said their existing cyber defenses are insufficient to deal with the growing complexity of ransomware attacks, although only 31% of those questioned think they will be victims of a ransomware attack in the future.