One in four organizations were victims of ransomware attacks over the past 12 months, a 61% decline from the previous 12-month period when 64% of organizations reported being victimized by extortionists, said Delinea, a privileged access management provider, in a new report.
Ransomware Payments Drop
In a study of some 300 U.S.-based IT professionals, the number of organizations coughing up ransom payments slid from 82% to 68%, signaling either that companies are better prepared to withstand and recover from a cyberattack, or as Delinea suggested, more were paying heed to law enforcement’s warning not to accede to hackers’ demands.
Moreover, the study found that larger companies are much more likely to be victims of ransomware, as 56% of companies with 100 or more employees said they were victims of ransomware attacks.
The survey also revealed that the consequences of ransomware attacks are now more tangible, as more respondents specified that their companies lost revenue (56%) and customers (50%) compared to the previous year. Fewer organizations (43%) reported reputational damage as a result of being victims of a ransomware attack.
"The reduction of ransomware attacks is an encouraging sign, but organizations need to make sure they keep their guard up against this constant, evolving threat," said Art Gilliland, Delinea chief executive. "Staying vigilant by maintaining a strong least privilege approach backed by stronger password protection, authentication enforcement, and access controls can help continue this downward trend."
Here are some additional study findings:
Larger companies are much more likely to be victims of ransomware, as 56% of companies with 100 or more employees said they were victims of ransomware attacks.
Budget allocations for ransomware are in decline, as only 68% of those surveyed said they are currently allocated budget to protect against ransomware versus 93% during the prior year.
The number of companies with Incident Response Plans also declined from 94% to 71%, and only half are taking proactive, proven steps to prevent ransomware attacks such as enforcing password best practices (51%) and using Multi-Factor Authentication (50%).
Healthcare a Favored Attack Target
The healthcare industry has long been among the most consistently lucrative and favored targets for hackers for its plethora of personal data and at times its subpar protections. Last October, The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) warned healthcare organizations about the Daixin Team, a cybercrime crew targeting U.S. businesses in the healthcare sector with ransomware and data extortion campaigns since June 2022.
The Daixin Teams’ tactics, techniques and procedures (TTPs) and indicators of compromise (IOCs) provides a good example of how ransomware attackers go after healthcare and other organizations:
Gained initial access to victims through virtual private network (VPN) servers.
Securing Against a Ransomware Attack
The federal agencies also provided a list of measures organizations can take to secure against a ransomware attack:
Turn off SSH and other network device management interfaces such as Telnet, Winbox, and HTTP for wide area networks (WANs) and secure with strong passwords and encryption when enabled.
