Key findings about the experience and impact of ransomware on organizations worldwide
Data encryption is now just one part of a ransomware attack
Around a quarter of the ransomware incidents experienced by respondents involved the encryption of data, locking endpoints and data theft. Attacks also featured lateral movement across the network, the infection of multiple endpoints, the installation of additional malicious payloads, privilege elevation, and embedding backdoors and other persistence mechanisms. Further, to make it harder for victims to restore their data without paying, around one in five attackers accessed and wiped backups and deleted shadow copies of files.
Ransomware victims lose customers and new business opportunities
Once the dust has settled on the actual attack, victims are left facing operational and commercial repercussions. The top impact cited by ransomware victims was damage to their brand and reputation, followed by downtime and recovery costs. A third admitted losing sensitive data. One in four ransomware victims faced the longer-term business impact of losing existing customers and new business opportunities.
