Eighty percent of Australian organisations surveyed were hit with ransomware in 2021, up from 45% in 2020, according to a new survey.

Sophos released its annual survey and review of real-world ransomware experiences in the State of Ransomware 2022.

According to the survey, the average ransom paid by organisations that had data encrypted in their most significant ransomware attack, was US$226,863, with 43% paying between US$100,000 US$499,999. Forty-three per cent of the organisations that had data encrypted paid the ransom to get their data back, even if they had other means of data recovery, such as backups.

The report summarises the impact of ransomware on 5,600 mid-sized organisations in 31 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East, and Africa, with 965 sharing details of ransomware payments. This included 250 in Australia, of whom 65 shared details of ransomware payments.

"Alongside the escalating payments, the survey shows that the proportion of victims paying up also continues to increase, even when they may have other options available," says Chester Wisniewski, principal research scientist at Sophos.

"There could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site," he says.

"In the aftermath of a ransomware attack there is often intense pressure to get back up and running as soon as possible. Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option. Its also an option fraught with risk.

"Organisations don't know what the attackers might have done, such as adding backdoors, copying passwords and more. If organisations don't thoroughly clean up the recovered data, they will end up with all that potentially toxic material in their network and potentially exposed to a repeat attack."

The main findings of the State of Ransomware 2022 survey for Australia, which covers ransomware incidents experienced during 2021, as well as related cyber insurance issues, include:

• Organisations are fighting back 99% of respondents have made changes to their cyber defences over the last year to improve their insurance position. Globally, 97% made changes with 64% implementing new technology/services, 56% increasing staff training and education activities, and 52% changing their processes and behaviours.
• Backups were the #1 method used for restoring data 70% of Australian respondents whose data was encrypted used this approach, 43% paid the ransom. By comparison, globally 73% of respondents used backups and 46% paid the ransom to restore data.
• Seventy-nine per cent of attacks resulted in data being encrypted This is notably higher than the global average of 65%, and a slight increase from the 74% reported by respondents in Australia in 2020. Ninety-nine per cent of those whose data was encrypted got some of their data back. This aligns with the global results where 99% reported getting at least some of their data back.

 
The impact of a ransomware attack can be immense The average cost to recover from a ransomware attack in 2021 was US$1.01 million. Australian organisations took on average one month to recover from the attack. Eighty-eight per cent of organisations said the attack had impacted their ability to operate, while 86% reported the ransomware attack caused their organisation to lose business/revenue.
 
Many organisations rely on cyber insurance to help them recover from a ransomware attack 91% of respondents in Australia said their organisation has cyber insurance that covers them if they are hit by ransomware, however 53% said the level of cybersecurity needed to qualify for insurance is higher, 50% said cybersecurity policies are now more complex, 39% said the process takes longer, and 36% reported that it is more expensive.
 
"The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers greed for ever higher ransom payments is colliding head on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure," says Wisniewski.

"In recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service.

"Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands," he says.

"However, the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky high ransoms.

"Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit."

Sophos recommends the following best practices to help defend against ransomware and related cyberattacks

• Install and maintain high-quality defenses across all points in the organisations environment. Review security controls regularly and make sure they continue to meet the organisations needs
• Proactively hunt for threats to identify and stop adversaries before they can execute their attack if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist
• Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines, open RDP ports, etc. Extended Detection and Response (XDR) solutions are ideal for this purpose
• Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated
• Make backups, and practice restoring from them so that the organisation can get back up and running as soon as possible, with minimum disruption