Impacts vary but, in many cases, ransomware disrupts businesses for significant periods—or even forces them to suspend operations or close. A growing population of highly capable cyber extortionists is developing new means to counter defenses and to increase the level of disruption they can inflict, constantly. Threats are widespread, they extend across industry and the public/private sector and they affect large and small businesses alike.
Security leaders must understand and counter new ransomware challenges, strengthen defenses across people, processes and technology and demonstrate why security is critical to the business strategy.
year-on-year increase in ransomware events in 2020—with little sign of any slow-down in early 2021
Source: CIFR intrusion data
ransom demanded from one of the world’s largest manufacturers—encrypted 1,200 servers, theft of 100GB of data, deleted 20 to 30TB back-ups. Source: Bleeping Computer
The Accenture Cyber Investigations, Forensics & Response (CIFR) team observed ransom demands ranging from US$100,000 to US$50M in 2020. Source: CIFR intrusion data
Today’s top three ransomware defense challenges
Successful ransomware extortionists are ramping up attacks
Established ransomware operators are upping their game as they continue to focus on new monetization opportunities and see no limits to the potential profits.
Ransomware operators are constantly improving their ability to disrupt
Cyber extortionists are incentivized to develop ever-more disruptive ways of working. The more disruption they can inflict, the larger the ransom they can demand.
Business growth and service strategies lack resilience
Downtime from ransomware can affect tens of millions of people. The theft and publication of data gives attackers new extortion opportunities—such as the risk of regulatory sanctions if protected information is made available online.
Ransom demands are growing and becoming more customized—with threat actors assessing who is more likely to pay. If ransoms are paid, it can open the door to further criminality. Some ransomware operators have been sanctioned, potentially placing a ransom-paying victim in further legal jeopardy.