Ransomware is fast becoming a ubiquitous security threat, with nearly 40% of all businesses experiencing an attack in the past year,
according to research from computer security firm Malwarebytes. The figure is even worse in Britain, where 54% of surveyed businesses had been targeted with such an attack
The group surveyed IT heads at over 500 companies in four countries, and found that more than one-third of the ransomware victims lost revenue as a result of the attack.
Although not new, ransomware has rapidly risen in popularity as a method of attacking businesses and other large organisations. The term refers to a number of versions of malicious software which takes control of a targets computer and then encrypts all the data on it, rendering it inaccessible. The software’s developers then demand a payment, typically in an digital currency such as bitcoin, in exchange for handing over the encryption keys.
The ransom demanded can be huge: one-fifth of British companies who had been hit by ransomware reported being charged more than $10,000 to unlock their files, and 3% of the demands were in excess of $50,000.
But just as many are low figures, with one-fifth coming in at under $500, which goes some way to explaining why so many businesses pay up. Malwarebytes’ research suggests that over half the businesses hit by ransomware in the UK will eventually pay, but the figure varies wildly internationally: 97% of American businesses didn’t pay the ransom, while 75% of Canadian ones did. The researchers suggest that in Britain, “infections tend to be more widespread … than they are in other nations, and ransomware had much more of an impact on the ability of UK-based organisations in terms of their loss of revenue resulting from the attacks.”
The difference may also be down to the response of police. American law enforcement organisations have been outspoken against victims paying ransoms to retrieve their data. The FBI’s cyber division assistant director, James Trainor, said “Paying a ransom doesn’t guarantee an organisation that it will get its data back—we’ve seen cases where organisations never got a decryption key after having paid the ransom.
“Paying a ransom not only emboldens current cyber criminals to target more organisations, it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organisation might inadvertently be funding other illicit activity associated with criminals.”
In other nations, responses are more sanguine: if the affected business does not have a backup of all their data, something true of around one-third of British victims in the Malwarebytes study, then paying the ransom may be the only way to secure the files they would otherwise lose.
Although responses to the attacks differ worldwide, the one common thread is that ransomware is growing as a threat everywhere. Nathan Scott, one of Malwarebytes ransomware experts, said “over the past four years, ransomware has evolved into one of the biggest cyber security threats in the wild, with instances of ransomware in exploit kits” – the separate pieces of software used to deliver malware on to a target computer, through known vulnerabilities in software like Adobe Flash or Windows – “increasing 259% in the last five months alone”.
“The impact on businesses around the world has been significant,” Scott added. “Until now, very few studies have examined the current prevalence and ramifications of actual ransomware incidents.”
