New Data Shows Sharp Rise in Ransomware Attacks, Payments Demanded From Hackers

Ransomware attacks hit at least over 200,000 organizations last year, and the average ransom demanded rose dramatically at the end of 2019.

• By Haley Samsel
• Feb 11, 2020

The ransomware crisis will get worse before it gets better, according to several experts interviewed by The New York Times in a report containing new data on the amount of businesses and public sector organizations hit by the malware.

While many businesses quietly pay ransoms and never report the attack to authorities, cybersecurity firm Emisoft collected data in 2019 showing the widespread nature of the attacks. Last year, 205,280 organizations submitted files that had been hacked in a ransomware attack, a 41 percent increase from 2018, according to the Times.

The average payment demanded by hackers to release files back to their owners rose to $84,116 in the last quarter of the year, according to data from Coveware. That number hiked up to $190,946 in December, when ransomware attackers were said to demand millions from larger corporations.

But even this devastating data cannot paint the full picture of ransomware attacks, as many corporations attempt to hide that they were the victims of ransomware due to fears that they will earn media attention and negatively affect investor confidence.

In addition, cyber-insurance providers -- many of whom help their clients pay the ransoms rather than attempt to recover the files through backups -- are raising insurance rates in the wake of higher demands and more frequent attacks. Businesses often do not report the incidents to the FBI, which tallied only 1,493 reports in 2018.

Steven Chabinsky, a lawyer and former deputy assistant director of the FBI’s cyber unit, told ProPublica that many businesses do not report because the FBI does not offer much assistance and can create another distraction in the middle of a crisis.

“Not that I’m saying corporate America is dishonest, but the last thing you want is a bunch of FBI agents crawling around your company,” Chabinsky added. “There is no benefit whatsoever of you reporting. There’s no incentive. And there’s clearly identifiable cost. It’s the cost, the disruption, the risk they talk to some employee and now you’re under investigation. There’s no upside.”

Security experts are also concerned about the rise in certain trends among attackers, including hackers releasing stolen files to the public in an effort to pressure or punish victims who have not paid the ransom. Federal authorities have struggled to address the attacks and their ramifications because the hackers largely operate outside of the U.S. using hard-to-track financial systems, most often Bitcoin.

In the meantime, one agency has taken action in an attempt to help businesses and organizations recover from the attacks. The National Institute of Standards and Technology released a set of free guidelines in January after it tested a variety of cybersecurity solutions in different IT environments to find out which methods were most effective in fighting ransomware.

Organizations can read the framework here and provide public comment on the report from now until Feb. 26.