A new study has found that one-third of companies that are hit with ransomware and pay the hackers to unlock their systems, are often likely to be targeted a second time.
And after they pay, they are often faced with significant fallout, including system rebuilding costs, their data still being leaked and financial implications, according to the “2022 Cyber Readiness Report” by Hiscox.
The eye-opening results of the study come as the number of businesses hit by cyber attacks continues growing.
Considering the potential damage to your organization and your systems in the aftermath of a ransomware attack, even if you have cyber insurance to pay recovery costs, it’s best to take steps to thwart attacks in the first place.
More than ransom
It’s clear that paying a ransom often doesn’t mean the recovery for an affected business will be smooth, according to the report, which covers the poll results of 5,000 organizations.
“Ransomware is still the most prevalent and damaging form of cyber attack and it is not uncommon for a company to be hit multiple times,” Gareth Wharton, Hiscox Cyber CEO, said in a prepared statement. “Even if a business owner makes the decision to pay the ransom, often they cannot fully restore their systems or prevent a data breach.”
The study found that:
- 36% of organizations that paid the ransom were hit again within 12 months.
- 41% of companies that paid the ransom and received the recovery key ended up with incomplete databases and were still forced to rebuild their systems.
- 29% of firms that paid the ransom demand still had data leaked.
- 26% of businesses paid a ransom in the hope of recovering their data because they did not have any back-ups.
- 26% of businesses hit by ransomware said the attack had threatened the solvency and viability of their operation.
The risk
Nearly half (47%) of firms reported that they had been hit by a cyber attack during the past 12 months, up from 40% in 2021. Of those who were attacked, 17% were ransomware victims.
The median cost of an attack has risen 29% to just under $17,000.
Criminals are increasingly targeting smaller firms. Companies with revenues of $100,000 to $500,000 can now expect as many cyber attacks as those earning $1 million to $9 million annually, Hiscox said in its report.
Additionally, the remote working trend makes cyber security more difficult, with 62% of firms saying that their business is more vulnerable to an attack as more staff work from home.
What you can do
Some firms have little exposure to a cyber attack, particularly if they don’t handle customer data or are not tech-driven operations. Each business has a different exposure level.
For companies that do have cyber exposure, protecting their organization requires a multi-pronged approach that includes cyber insurance and strong data security protocols.
Cyber insurance may cover the cost of a paid ransom, as well as recovery and rebuilding costs. If your organization has exposure, please give us a call to review your risk and see if cyber coverage is right for your business.
Besides that, Hiscox recommends taking a number of steps to protect against an attack and be able to recover from one faster:
- Keep all of your software up to date to include the installation of all of the latest security patches.
- Frequently back up your data on a server that is not hooked up to the cloud.
- Conduct frequent training for your staff on how to recognize and avoid common social engineering attacks that criminals use to trick them into revealing sensitive information about themselves or their company.
They should also be taught how to detect potentially dangerous e-mails that try to get them to click on a malicious link that can unleash ransomware or other malware.