Impact of ransomware causing significant damage to the revenue and reputation of UK businesses

Sunnyvale, Californi: Ransomware attacks are disrupting and undermining business operations and draining revenue streams, according to new research from the Ponemon Institute, commissioned by Illumio, Inc.. 

Findings from The Global Cost of Ransomware Study reveal that 62% of UK organisations had to shut down operations following a ransomware attack.  Forty-one per cent lost customers; 37% had to eliminate jobs; and 34% reported a significant loss of revenue.  

The research examined the scope of ransomware threats confronting organisations and the measures being implemented to reduce the risks and their impacts. Key findings include: 

• Attackers are reaching critical systems to cause maximum disruption: Ransomware attacks impacted 23% of critical systems, with systems down for 12 hours on average. 

• Organisations continue to spend significant time and money containing ransomware: On average, it took 18.8 people, 126 hours each to contain and remediate their largest ransomware attack. 

• Costs associated with reputation and brand damage now exceed those from legal and regulatory actions: 36% experienced significant brand damage from an attack. 

• Failure to prioritise investments that boost resilience is costing businesses: 48% cent lack the ability to quickly identify and contain attacks, and only 35% have implemented microsegmentation – a vital control for stopping the spread of breaches. 

“Ransomware is more pervasive and impactful than ever, but not all attacks need result in the suspension of operations or major business failure,” said Trevor Dearing, Director of Critical Infrastructure at Illumio. “Organisations need operational resilience and controls like microsegmentation that stop attackers from reaching critical systems should be non-negotiable. By containing attacks at the point of entry, organisations can protect critical systems and data, and save millions in downtime, lost business, and reputational damage.” 

Cloud and hybrid environments remain weak links, with attackers exploiting unpatched systems 

The increased connectivity of business systems and devices is making it harder for organisations to defend against ransomware attacks. Organisations perceive the cloud and endpoints as being the most vulnerable, and 34% say a lack of visibility across hybrid environments makes it difficult to respond to ransomware attacks. 

Desktops and laptops remain the most compromised devices (65%), with phishing and software vulnerabilities cited as top entry points for ransomware. Over half (56%) of attacks moved across the network to infect other devices, with the top techniques used to move laterally and escalate system privileges being the exploit of weak passwords (53%), cached credential attacks (28%) and exploitation of unpatched systems (43%). 

Organisations are investing heavily in ransomware defense, but efforts are falling short 

According to the research, UK organisations are allocating less than a fifth of IT budget (19%) to staff and technologies meant to prevent, detect, contain, and resolve ransomware attacks – significantly lower than other countries.  Eighty-one per cent of organisations also admit to falling victim to a ransomware attack, despite 48% being confident in their security posture. 

Organisations are also taking a chance on ransomware recovery and failing. Fifty-four per cent of respondents believe having a full and accurate backup is a sufficient defense against ransomware. Yet only 14% were able to recover all impacted data following a ransomware attack.  

The report also found larger organisational challenges in defending against ransomware including: 

• Ransomware reporting is still not happening: 73% of those that experienced a ransomware attack didn’t report it to law enforcement. Top reasons for not reporting include not wanting to publicise the incident (43%);  being up against a payment deadline (40%); and fear of retaliation (36%).  

• Employees remain a weak link in security: Only 40% are confident in the ability of employees to detect social engineering lures, and insider negligence is the top challenge when responding to ransomware attacks. 

• Organisations are slow to adopt AI to combat ransomware: Only 40% have specifically adopted AI to help combat ransomware. More (46%) are concerned their organisation may experience an AI-generated ransomware attack.