[Sponsored] Protecting Against Ransomware Attacks: Lessons from Recent POPIA Fine

Issue 6 2023 Cyber Security, Security Services & Risk Management

The South African Department of Justice recently faced a hefty fine from the PoPIA regulator due to a data breach caused by a ransomware attack. This incident serves as a stark reminder of the increasing threat posed by ransomware to organisations. According to Sophos’s most recent ransomware report, an alarming 78% of the South African organisations that Sophos surveyed experienced ransomware attacks in the past year.

Here we delve into the key statistics from the report and provide insights on how companies can bolster their security measures to mitigate the risk of data loss.

The growing ransomware threat: In South Africa, exploited vulnerabilities were the primary cause of ransomware attacks, as mentioned in the survey, accounting for 49% of incidents. Additionally, compromised credentials were used in 24% of attacks. These figures highlight the critical importance of addressing vulnerabilities promptly and adopting robust identity management protocols to safeguard against unauthorised access.

Data encryption and theft: An alarming 89% of attacks resulted in data encryption, surpassing the global average of 76%. Disturbingly, data theft occurred in 35% of attacks where data was encrypted, higher than the global average of 30%. This underscores the need for organisations to reduce time to detection and time to respond preventing data exfiltration and encryption.

Effective recovery methods: Fortunately, 100% of South African organisations whose data was encrypted managed to recover their data, slightly surpassing the global average of 97%. Backups continue to be the most common method for data restoration, with 76% of South African respondents utilising this approach. Maintaining comprehensive and up-to-date backups is crucial to quickly restore data and minimise downtime.

The dilemma of ransom payments: While it is discouraging that 45% of the organisations surveyed in South Africa paid the ransom, this figure has seen a slight decline compared to previous years. It is essential to emphasise that paying the ransom does not guarantee the return of stolen data or prevent future attacks. Organisations should focus on implementing preventive measures to avoid falling victim to ransomware in the first place.

Parallel recovery methods and costs: Approximately 24% of South African organisations that experienced data encryption used multiple recovery methods simultaneously, demonstrating the importance of a multi-faceted approach to data restoration. Furthermore, the average cost incurred by South African organisations for recovering from a ransomware attack, excluding ransom payments, was $750 000. Although this is lower than the global average, organisations must consider the comprehensive impact on downtime, lost opportunity and other associated costs.

Business impact and recovery time: Ransomware attacks have severe implications for businesses. In South Africa, 82% of affected organisations surveyed reported losing business and revenue, which is slightly lower than the global average of 84%. Recovery times varied, with 53% taking up to a week, 29% requiring up to a month, and 19% facing recovery periods of one to six months. Minimising downtime and implementing efficient incident response plans are crucial to reduce the operational and financial impact of attacks.

The role of cyber insurance: The report reveals that 98% of South African organisations have some form of cyber insurance coverage, with 66% acknowledging that the quality of their defences affected their ability to obtain coverage. In addition, 61% stated that the quality of their defences influenced the cost of their premiums. This highlights the importance of maintaining robust security measures as a prerequisite for obtaining comprehensive cyber insurance coverage.

The recent fine imposed on the Department of Justice reinforces the urgent need for organisations in South Africa to fortify their defences against ransomware attacks. By addressing vulnerabilities, implementing strong authentication measures, prioritising data backup strategies, and fostering a comprehensive incident response plan, companies can significantly reduce the risk of data loss. Additionally, organisations should strive to maintain cyber insurance coverage that aligns with their security posture, ensuring adequate protection and financial support in the event of an attack.

Find out more at www.sophos.com

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Protect your financial assets from unknown online threats
Products Cyber Security Financial (Industry)
Malicious actors employ a myriad of sophisticated techniques, such as hacking, phishing, spamming, card theft, online fraud, vishing, and keylogging, among others, to exploit unsuspecting individuals and gain unauthorised access to their financial resources.

Cyber incidents result in a 9% decrease in shareholder value
News Cyber Security
Aon published its 2023 Cyber Resilience Report, revealing that, on average, a significant cyber incident resulted in a 9% decrease in shareholder value – over and above the market – in the year following the event.

Automated ransomware recovery
Products Cyber Security
Organisations can now automatically recover from ransomware attacks with the capabilities in Cisco XDR, where the company is adding recovery to the response process by including infrastructure and enterprise data backup and recovery vendors.

NIST’s impact on cybersecurity
Cyber Security
Through its NIST Cybersecurity Framework, the non-regulatory agency empowers organisations to take a proactive approach towards managing and mitigating cyber risks, enabling them to stay resilient against the ever-evolving threat landscape.

Best practice tips for strengthening data privacy system
Security Services & Risk Management Cyber Security
International cybercriminals are increasingly targeting South African organizations, making data privacy more difficult to maintain. A standardization expert offers insight to help combat this threat.

AI-powered cyber protection for consumers
IT infrastructure Cyber Security
Acronis Cyber Protect Home Office is designed for the evolving landscape of cyber threats by integrating Acronis' cyber protection and secure backup solutions, combining AI-powered defence mechanisms, robust data backup, remote management tools, and mobile device protection.

Is AI the game-changer for streamlining anti-money laundering compliance?
Financial (Industry) Security Services & Risk Management
In the aftermath of South Africa's recent grey listing, companies are now confronted with the imperative to address eight identified strategic deficiencies, while simultaneously reducing their financial crime risk through anti-money laundering compliance processes.

Client satisfaction boosted by 85% at Thungela Mine
Thorburn Security Solutions News Security Services & Risk Management Mining (Industry)
Thorburn Security, a division of Tsebo Solutions Group, has announced its recent collaboration with Kwa-Zulu Natal security company, Ithuba Protection Services, as part of its Enterprise Supplier Development (ESD) initiatives across Africa.

A surge of cybersecurity for the energy sector
Government and Parastatal (Industry) Cyber Security
With a rapid transition towards renewable energy, the energy sector has an increased reliance on technology. This makes it particularly vulnerable with regards to cybersecurity, as it depends on interconnected systems and digital technologies.

Secure backup strategies imperative for business continuity
IT infrastructure Cyber Security
Cybercrime is on the rise, and businesses need to adjust how they manage their data to fend off attackers, or risk irreparable damage, writes Lisa Strydom, Senior Manager Channel and Alliance for Africa at Veeam Software.