Ransomware Explained - Increasing Costs and Impact

Ransom risks are skyrocketing. It's a growing threat to organizations and national critical infrastructures connected to the internet. Therefore, it puts in jeopardy all the products, services, and basic functions that citizens depend upon every single day. It can and will eventually impact everybody. Now, this is the first in a series of videos on ransomware. And today we're going to cover the growth, the cost, the impacts, and why paying ransoms is such a bad idea. Now, ransomware is growing at phenomenal speeds. The US Department of Justice actually declared 2020 the worst year ever for ransomware. And it's getting worse. So far this year, we've already seen over a 100% increase in attacks. And ransomware perpetrators, they carry out more than 75,000 attacks daily. Think about that for a second. And the experts that I've talked with, well, we expect ransomware to grow at least 200 to 300% per year, every year for the foreseeable future, unless we do something drastic. And the cost of all of this, well, it's also increasing. The ransoms that the attackers are asking for, well, that amount has tripled from 2019 to 2020. And ransoms for organizations, the big businesses or agencies that they impact, Um, they're seeing the ranges now in the $200,000 to $2 million range. And some of the ransoms we're seeing are into the tens of millions of dollars. In fact, recently an insurance company paid a $40 million ransom. Now the average cost of remediation, and that would include all the costs to basically recover and get back to normal. It's more than doubled in the last year from an average of 760,000 in 2020 to over 1.8 million in 2021. And the attackers, they know that the bigger targets that provide crucial functions, they may pay the higher ransoms. That's why they're targeting them. Now, global ransomware damages, they've been rising over the years. If we go back in time and look back in 2017, it was estimated at about $5 billion. And when we jump ahead to 2019, it was over $11 billion. But for 2021, it's estimated at over $20 billion. And in, by 2031, It's 10x that at $265 billion. And the reality is, I believe these numbers are actually low. We're seeing an increase and more momentum in this space. More attackers, more attacks, more money being paid out, more impacts. I think these numbers are low. I think we're going to see a lot more because of the rate of increase that we're seeing right now in ransomware. But keep in mind, the dollar cost really isn't the biggest problem. It's not the biggest worry. What we're seeing now are critical infrastructures being targeted and hit, and that causes a much wider and greater impact to all citizens. And if we take, for example, hospitals, and medical services. Attacks against them, that disrupts patient care. The healthcare industry lost an estimated $7.5 billion to ransomware back in 2019, and that number's just going up. And if we kind of think about, well, how susceptible are they to attack? Consider this: more than 93% of healthcare organizations experienced a data breach in the past 3 years, 93%. Now, if they can be victimized with a data breach, chances are they can also be victimized with ransomware. And ransomware creates disruption that can literally impact lives. When we're talking about hospitals, this is a health and safety issue. Last year, a ransomware attack in Europe may have contributed to a woman's death. It would've been the first one that we've seen, but probably not the last. Healthcare is currently one of the favorite targets of ransomware. Why? Because they tend to get paid, right? That level of urgency means there's dollars flowing to the attackers. But healthcare isn't the only critical infrastructure that's getting attacked. Consider national fuel distribution. The Colonial Pipeline, the largest fuel pipeline in the US, was impacted last month with ransomware. Food production. Just this month, JBS Foods, the world's largest meat processing firm, also hit with ransomware. We're seeing it across transportation, manufacturing. Actually, manufacturing represents nearly a quarter of all ransomware attacks. Uh, we see it in the services sector. Education is getting hit quite hard. We're seeing more and more in the utility space. Think power, sanitation, water supply. We're seeing federal and state agencies being impacted. We've even seen entire city governments go down. Uh, if you recall Atlanta in 2018, it was brought to its knees and affecting 6 million people in the greater metro area there. So when it's hitting critical infrastructure, it can have massive impacts. And we're seeing that's where ransomware is going. It's expanding to that to include critical infrastructure. Now, overall, when you think about when the attackers receive a payment, when the victim pays the ransom, that's really fueling this continual growing cycle of pain. Ransomware attacker success feeds what we call the greed principle. And to distill that down, the greed principle is really simple. If an attacker can steal $10 from you today, well, their greed is going to drive them to try and steal $15 from you tomorrow. So the problem just continues to grow. Now, being paid, it motivates attackers to conduct more attacks and better attacks, attacks that have greater impacts. Therefore, there's a greater chance that they're gonna get paid. It also gives insights onto which industries to target because of their willingness to pay. And long-term, well, that's even more disturbing. It attracts more entry-level attackers into this ransomware as a service industry. Where these new people entering into this need no technical skills. And we've seen many of these ransomware as a service frameworks pop up. Arevil, Maze, Ryuk, LockBit, DarkSide, Egregor, all of those, right, were tailored to bring in these novice affiliates. And they're used to simply distribute malicious links or attachments and convict and convince victims to open them or launch them. And the ransomware as a service framework, it automates the rest of the work and then splits the percentage with those affiliates, right? The profits with them. So it's a very efficient system and it is scalable. This profit potential will be very appealing to the billions of people who have yet to join the internet. And we have to remember, right, more than half of the world makes less than $20 a day. So this could appear as a life-changing opportunity. And that's not what we want. We don't want a lot of the next billion people joining the internet to become cyber criminals and distribute ransomware. That's bad for everybody. At a scale that we can't even fathom. Now ransomware payments are essentially directly supporting these cybercriminals and it's fueling further attacks. It gives those attackers the resources to expand, to scale up, and to improve their methods and their tactics. Every ransomware payment creates more victims. Look at it that way. Every time a ransom is paid, more victims are going to happen. When we look at the stats, paying the ransom is really a terrible option. In 2021, 32% of organizations paid the ransom, and that was actually an increase from 26% in 2020. Given that though, only 8% managed to get back all of their data, and 65% of the encrypted data was restored after a ransom was paid. Not 100%. On average, only 65%. Often paying the ransom, organizations don't get the easy and complete fix they expect. What they do get, however, is they get to be targeted again. In fact, some ransomware crews go out of their way to guarantee they won't impact that company for a whole year. Hmm. Obviously what they're not saying is they will be back to revisit their favorites, those victims who have shown a willingness to pay. So anybody that pays, you're on the list, you're gonna be targeted again, guaranteed. And in conclusion, right, when we look at all of these numbers and stats Ransomware, it's gaining momentum and it's causing both tremendous financial losses, but now also targeting the critical infrastructures that could be devastating to the citizens of entire nations. The global digital ecosystem and that everything that relies upon it could be impacted. Paying ransoms, it just makes the problem bigger. And has many unforeseen and unexpected additional consequences. So that needs to be taken into account. Now ransomware, it represents a risk of national disruption and also life safety. And ultimately we need to address this and do it quickly. Thanks for watching. This is one session of a multi-part series on ransomware. The series is free. On the Cybersecurity Insights YouTube channel. And, you know, as security industry business leaders and government professionals, we all grow stronger to defend against cyber threats. Well, the more we share and collaborate. So I urge you to subscribe and watch all of the videos for strategic insights that fuel the ransomware events unfolding in the news and impacting us all. Please comment and let's discuss how best to understand and defeat ransomware. And be sure to check out the rest of the videos in this series.