In 2020, businesses made ransomware payments of more than $400 million in cryptocurrency, a 300% increase compared to 2019. However, the average cost to a business in terms of financial impact, down time and lost opportunity is far greater.
Public and media awareness of businesses impacted by a ransomware attack is high; as information is provided through the media on the possible causes of ransomware and reassurances given by senior executives. Unfortunately, what is never really discussed in the media is the overall business impact to that company as a result of the ransomware attack.
Financial impact of ransomware
External sources estimate that a ransomware attack occurs in the tens of seconds. Various surveys conducted yearly by cyber security vendors also highlight a number of issues, including the ability of cybercriminals to encrypt data for a large percentage of businesses that have experienced high profile attacks, to businesses unsuccessfully restoring files after ransom demands are paid.
To put things into perspective some of these surveys have included interviewing more than 6000 businesses across the globe, consisting of small businesses to large corporates (equal split), where the findings have indicated that more than 40% have been hit by ransomware and from that at least 50% are stating that cybercriminals have been successful in encrypting the company’s data. Furthermore, on average ransom paid by some of these companies was between US$100,000 to US$400,000 in cryptocurrency per company.
However, the average cost of rectifying a ransomware attack, taking into account down time, investment in resources, and most importantly damage to brand and opportunities lost is estimated by some external sources to be in excess of $2 million to businesses. These figures clearly indicate the sheer volume of ransomware attacks across the globe and the overall impact.
Government bodies, energy/utilities and business/professional services sectors struggle the most in defending against ransomware attacks.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataGlobalData’s research and discussions with industry highlights that government bodies (central and regional, subsidiaries), business/professional services and energy/utilities sectors struggle the most in defending against ransomware attacks. There’s no one reason for this and includes are number of factors:
- Dispersed legacy nature of government IT which over time has improved with upgrades but still has the vulnerabilities to cyber-attacks.
- Despite the growing threat of ransomware cyberattacks on sectors, Utilities and Energy are still behind the curve in creating robust security policies and resilient network fortification. The emergence of OT/IoT makes these verticals more vulnerable.
- The realization by cyber criminals of the ‘high impact’ cyber attacks can create on verticals like utilities, energy and government, and the opportunity this creates in increased ransom demands.
In comparison, sectors like Healthcare have seen far fewer attacks, though they are not immune. This reflects the trend that in the last two years’ Healthcare leaders have demonstrated a desire to take positive steps to increase security measures across enterprise IT and networks. GlobalData is also seeing a greater proportion (5%-10%) of the IT budget spent on cybersecurity in Healthcare.. However, as previously covered a number of barriers still exist in providing greater levels of security in Healthcare. These include the rapid emergence of new threats, lack of security policies across the organization, poor governance, and complex configuration of endpoint devices and networks of which some are within the legacy environment.
Understanding the business impact of ransomware
As already mentioned, the financial angle is just one part of the problem of ransomware to a company, and most businesses only realise the full extent of the impact ‘post’ the attack. The full impact takes into account down time, investment in resources, opportunities lost and brand damage. Furthermore, a ransomware attack takes on average +10-20 days in terms of down time and can be quite complex technologically to resolve, even with outside contractor/specialist support. Critical milestones include manually restoring servers depending on how many there are, and minimizing downtime.
For example, Universal Health Services (UHS) reported a cyber-attack incident in 2020 and had a $67 million economic impact to the business. The incident was believed to be caused by the Ryuk variant ransomware. The company stated that they incurred significant incremental labor expenses, both internal and external, to restore information technology operations as expeditiously as possible.
Additionally, administrative functions covering coding and billing were delayed which in turn had an impact on UHS’ operating cash flow during the fourth quarter. Lastly, the company also incurred further labor expenses, professional fees and other operating expenses due to the incident and the related disruption of operations. Overall, UHS estimated that approximately $12 million of the “unfavorable pre-tax impact” was experienced during the third quarter of 2020, and approximately $55 million was experienced during the fourth quarter. There are many other examples including Colonial Pipeline, Boeing, Lockheed Martin and Tesla.
Assessing the overall risks to the business is crucial
Assessing the risks to the business as part of the security risk strategy is crucial to successfully address ransomware attacks. However, the issue is that risk assessments and contingencies are often confined to the IT and network environment. Here, typically cyber-attack risk assessments are conducted examining security technology defences, policies and business continuity recovering plans. They do not include the potential impact on the brand, overall financial health, and impact on customers and supply chain.
Based on the conversations GlobalData has had with senior executive leaders in end-user businesses and providers of cybersecurity services/products, our recommendations are as follows:
- Future cybersecurity risk assessments should take into consideration the impact on operations, company performance, brand, customers and share-holder value, and implement contingencies.
- Addressing ransomware is not just a CISO issue, but needs to include good governance involving the executive board including the CEO, CFO, CMO, Head of Operations and regulatory/compliance.
- From an IT infrastructure perspective protect backup systems, create a robust ransomware recovery environment as part of the disaster recovery strategy, implement greater authentication of administrator accounts, and introduce zero-trust architecture, resilience and end-to-end visibility across the IT environment.
Related Company Profiles
Lockheed Martin Corp
Universal Health Services Inc