Real-world ransomware

Issue 2 2022 News & Events

Sophos has released its annual international survey and review of real-world ransomware experiences in the State of Ransomware 2022. The report shows that 51% of South African organisations surveyed were hit with ransomware in 2021; and 49% of the organisations that had data encrypted paid the ransom to get their data back, even if they had other means of data recovery, such as backups.

The report summarises the impact of ransomware on 5600 mid-sized organisations in 31 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East and Africa.

“The survey shows that, globally, the proportion of victims paying the ransom continues to increase, even when they may have other options available,” said Chester Wisniewski, principal research scientist at Sophos. “There could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site. In the aftermath of a ransomware attack there is often intense pressure to get back up and running as soon as possible. Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option. It’s also an option fraught with risk. Organisations don’t know what the attackers might have done, such as adding backdoors, copying passwords and more. If organisations don’t thoroughly clean up the recovered data, they’ll end up with all that potentially toxic material in their network and potentially exposed to a repeat attack.”

The main findings for South Africa in the State of Ransomware 2022 global survey, which covers ransomware incidents experienced during 2021, as well as related cyber insurance issues, include:

• A significant number of victims are paying the ransom.

• The impact of a ransomware attack can be immense. The average cost to recover from the most recent ransomware attack in 2021 was US$ 710 000. It took on average one month to recover from the damage and disruption. A huge 95% of organisations said the attack had impacted their ability to operate, and 92% of the victims said they had lost business and/or revenue because of the attack.

• Many organisations rely on cyber insurance to help them recover from a ransomware attack; 77% of mid-sized organisations had cyber insurance that covers them in the event of a ransomware attack and in 99% of incidents, the insurer paid some or all the costs incurred.

• A substantial 93% of those with cyber insurance said that their experience of getting it has changed over the last 12 months, with higher demands for cybersecurity measures, more complex or expensive policies and fewer organisations offering insurance protection.

“The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers’ greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure,” said Wisniewski.

“In recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service. Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands. However, the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky high ransoms. Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit.”

Sophos recommends the following best practices to help defend against ransomware and related cyberattacks

1. Install and maintain high-quality defences across all points in the organisation’s environment. Review security controls regularly and make sure they continue to meet the organisation’s needs.

2. Proactively hunt for threats to identify and stop adversaries before they can execute their attack. If the team lacks the time or skills to do this in house, outsource to a managed detection and response (MDR) specialist.

3. Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines, open RDP ports, etc. Extended detection and response (XDR) solutions are ideal for this purpose.

4. Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated.

5. Make backups, and practice restoring from them so that the organisation can get back up and running as soon as possible, with minimum disruption.

Read The State of Ransomware 2022 report for the full global findings and data by sector at www.sophos.com/en-us/content/state-of-ransomware




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
The power of PKI and private sector innovation
Access Control & Identity Management News & Events Government and Parastatal (Industry)
At the recent ID4Africa 2025 Summit in Addis Ababa, the spotlight was firmly on building secure, inclusive, and scalable digital identity ecosystems for the African continent.

Read more...
Bosch Security renamed Keenfinity
News & Events
Globally renowned brands for video systems, access control and intrusion alarm systems, as well as communication systems, unite under the roof of the new company Keenfinity Group.

Read more...
2025 video surveillance market set for improved fortunes
News & Events Surveillance
Novaira Insights has unveiled its latest report, World Market for Video Surveillance Hardware and Software – 2025 Edition, forecasting a healthy growth rate of 8,1% until 2029, excluding China.

Read more...
Wialon announces integration with fleet maintenance and optimisation platform
News & Events Transport (Industry) Logistics (Industry)
Fleet management software platform integrates with a fleet maintenance and optimisation platform to support mutual customers for better workflows and deeper insights into fleet operations.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Value and industry insight
Securex South Africa Training & Education News & Events
Securex South Africa 2025, co-located with A-OSH EXPO, Facilities Management Expo, and Firexpo, drew thousands of security professionals from across the continent and beyond, offering a platform for networking, product discovery, and knowledge sharing.

Read more...
Gallagher Security achieves ISO 27001 recertification
News & Events Training & Education
Gallagher Security has successfully achieved certification to the updated ISO/IEC 27001:2022 standard for Information Security Management Systems (ISMS). This accomplishment builds on previous certifications and reflects a continued commitment to the highest standards of information security.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.