printer friendly version

[Sponsored] Protecting Against Ransomware Attacks: Lessons from Recent POPIA Fine

The South African Department of Justice recently faced a hefty fine from the PoPIA regulator due to a data breach caused by a ransomware attack. This incident serves as a stark reminder of the increasing threat posed by ransomware to organisations. According to Sophos’s most recent ransomware report, an alarming 78% of the South African organisations that Sophos surveyed experienced ransomware attacks in the past year.

Here we delve into the key statistics from the report and provide insights on how companies can bolster their security measures to mitigate the risk of data loss.

The growing ransomware threat: In South Africa, exploited vulnerabilities were the primary cause of ransomware attacks, as mentioned in the survey, accounting for 49% of incidents. Additionally, compromised credentials were used in 24% of attacks. These figures highlight the critical importance of addressing vulnerabilities promptly and adopting robust identity management protocols to safeguard against unauthorised access.

Data encryption and theft: An alarming 89% of attacks resulted in data encryption, surpassing the global average of 76%. Disturbingly, data theft occurred in 35% of attacks where data was encrypted, higher than the global average of 30%. This underscores the need for organisations to reduce time to detection and time to respond preventing data exfiltration and encryption.

Effective recovery methods: Fortunately, 100% of South African organisations whose data was encrypted managed to recover their data, slightly surpassing the global average of 97%. Backups continue to be the most common method for data restoration, with 76% of South African respondents utilising this approach. Maintaining comprehensive and up-to-date backups is crucial to quickly restore data and minimise downtime.

The dilemma of ransom payments: While it is discouraging that 45% of the organisations surveyed in South Africa paid the ransom, this figure has seen a slight decline compared to previous years. It is essential to emphasise that paying the ransom does not guarantee the return of stolen data or prevent future attacks. Organisations should focus on implementing preventive measures to avoid falling victim to ransomware in the first place.

Parallel recovery methods and costs: Approximately 24% of South African organisations that experienced data encryption used multiple recovery methods simultaneously, demonstrating the importance of a multi-faceted approach to data restoration. Furthermore, the average cost incurred by South African organisations for recovering from a ransomware attack, excluding ransom payments, was $750 000. Although this is lower than the global average, organisations must consider the comprehensive impact on downtime, lost opportunity and other associated costs.

Business impact and recovery time: Ransomware attacks have severe implications for businesses. In South Africa, 82% of affected organisations surveyed reported losing business and revenue, which is slightly lower than the global average of 84%. Recovery times varied, with 53% taking up to a week, 29% requiring up to a month, and 19% facing recovery periods of one to six months. Minimising downtime and implementing efficient incident response plans are crucial to reduce the operational and financial impact of attacks.

The role of cyber insurance: The report reveals that 98% of South African organisations have some form of cyber insurance coverage, with 66% acknowledging that the quality of their defences affected their ability to obtain coverage. In addition, 61% stated that the quality of their defences influenced the cost of their premiums. This highlights the importance of maintaining robust security measures as a prerequisite for obtaining comprehensive cyber insurance coverage.

The recent fine imposed on the Department of Justice reinforces the urgent need for organisations in South Africa to fortify their defences against ransomware attacks. By addressing vulnerabilities, implementing strong authentication measures, prioritising data backup strategies, and fostering a comprehensive incident response plan, companies can significantly reduce the risk of data loss. Additionally, organisations should strive to maintain cyber insurance coverage that aligns with their security posture, ensuring adequate protection and financial support in the event of an attack.

Find out more at www.sophos.com

Share this article:

Further reading: