Economic Impact: Data reveal that ransom costs resulting from ransomware attacks amount to billions of dollars per year. They arise from ransoms, which usually fall between thousands and millions of dollars but also from costs due to system downtimes, data retrieval, and restructuring after attacks (Zhang, and Huang, 2024). The average total cost of ransomware attacks, including indirect costs continues to trend upwards and some large organizations reported incident costs of over $10m., as reported by the industry.
Figure 1: Trend of ransomware data exfiltration and payment resolution status(Source: McIntosh et al., 2024)
Operational Impact: Ransomware halts business processes anywhere and especially in healthcare, utilities, and transportation systems. For instance, the ransomware attacks on the hospitals means they have to postpone treatments, and where there are emergencies the patients have to be transferred to other hospitals.
Also Read: What is Ransomware?
Reputational Damage: Ransomware also has more than tangible impacts on the organization’s functioning and its financial indicators; it also affects an organization’s image and reputation. People become less trusting of businesses that do not protect their information with their permanent and temporary loss of business, customer defections, and lowered revenues to which the company is subjected. Business also have the pressure from the regulators, especially in case when it is get leaked some important information.
Recent Ransomware Incidents
Ransomware is now one of the most common and dangerous types of threats in the field of cybercrime, affecting absolutely all segments of people and enterprises. Through the capacity to lock and scramble the data, threatening to halt operations and spread rampantly, ransomware attacks have become a rising threat in the area of cyberattacks.
Colonial Pipeline (2021)
The recent infamous attack that happened on the Colonial Pipeline was a result of the Dark Side ransomware group leaving the US in a fuel crisis. The pipeline which provides nearly 50 % of fuel to the east coast was closed for almost five days resulting in panic buying, shortages and high prices.
Figure 2: Process of Access to Colonial Pipeline Infrastructure (Source: Beerman et al., 2023)
The attackers locked Colonial’s IT infrastructure, and in exchange for the decryption key required $4.4M of which some were seized by the US government (Beerman et al., 2023). This attack brought into the foreground even the strengths of the critical infrastructures and the need to strengthen the cybersecurity.
Kaseya (2021)
The recent cyberattack on Kaseya was by the REvil ransomware group targeting an exposed flaw in the Kaseya VSA software used by MSPs. This attack targeted MSPs that provided IT services to about 1,500 companies all around the world. An attack encrypted the data and sought $70 million worth of bitcoin to release the decryption key. This called for a concern on the vulnerability of IT service providers to cyber-attacks with significant consequences to small business, large business and even government.
NHS WannaCry (2017)
WannaCry ransomware attack that targeted organizational systems ran on Windows severing a larger part of the United Kingdom’s National Health Service and global healthcare institutions. Hospitals received cancelled appointments, diverted ambulances, and changes in patient procedures (Wheeler et al., 2022). This only highlighted the importance of timely update and security in the healthcare software system because it resulted in approximately $4 billion of damage.
Figure 3: WannaCry Infection Heat Map (Source: Wheeler et al., 2022)
More recent ransom attacks have proven to be more protracted and elaborate in their working. A new tactic popularly known as double extortion is when apart from encrypting data, the attacker informs the victim that the data will be released if the ransom is not paid.
Cybercriminal seeks historically are targeting other industries that can cause high impacts including utilities, healthcare and supply chain industries because of the knowledge that quick payments will be achieved once the service is disrupted.
In the next article, will guide you, how to prevent attacks?
