State and local governments and the media, leisure and entertainment sectors are the most at risk of having their backups compromised during a ransomware attack the study found that 99% of the organisations in these industries that were hit by ransomware in the last 12 months had their backups targeted by cybercriminals ( Figure C).įigure C The percentage of ransomware attacks where adversaries attempted to compromise backups in different industries. Which industries are most at risk of having their backups targeted during ransomware attacks? Sophos analysts predicted this is because of the additional work necessary to restore systems from decrypted backup data, and organisations with vulnerable backups are less likely to have a strong recovery plan in place. Companies with compromised backups paid eight times more on the total recovery effort than those whose backups remained untouched.įurthermore, only 26% of companies with compromised backups were fully recovered within a week, compared to 46% of those without compromised backups. The total cost of a ransomware attack is often more than just the ransom, as it incorporates the recovery of any impacted systems and the losses incurred by any downtime. Those whose backups are compromised will pay 98% of the demanded sum, on average. “Ransomware-led outages frequently have a considerable impact on day-to-day business transactions while the task of restoring IT systems is often complex and expensive,” Sally Adam, the senior director of marketing at Sophos, wrote in the report.Ĭompanies without compromised backups are also more likely to be able to negotiate the ransom payment down, paying out an average of 82% of the initial demand. When the backup is not compromised, the median ransom demand is $1 million (£790k), as the attacker has less leverage.įigure B The median ransom demanded by cyber criminals when they have access or don’t have access to their victim’s backups. The Sophos research found that the median ransom demand for organisations whose backups are compromised is $2.3 million (£1.8 million) ( Figure B).

SEE: What is ransomware? Read this TechRepublic cheat sheet How much does it cost to recover from a ransomware attack on the backup? The Sophos research revealed the extent of the popularity and effectiveness of ransomware groups targeting corporate backups ( Figure A).įigure A Percentage of ransomware victims that paid the ransom to recover their data from cyber criminals. Indeed, the report showed the victim is almost twice as likely to pay up if their backup is compromised, and recovery from the attack is eight times more expensive. To put more pressure on decision-makers to pay up, it is becoming more common for them to target the duplicated data as well as the production data. The report showed that cybercriminals attempted to compromise the backups of 94% of companies hit by ransomware in the past year.Īttackers are aware that those who fall victim to ransomware must choose to either pay the ransom or recover their now-encrypted systems from a backup. Organisations that have backed up their sensitive data may believe they are relatively safe from ransomware attacks however, this is not the case based on findings from a new study from IT security company Sophos. Discover advice from security experts on how to properly protect your backup.

Research has found that criminals can demand higher ransom when they compromise an organisation’s backup data in a ransomware attack.

Sophos home premium review