{"id":24227,"date":"2024-04-15T08:27:34","date_gmt":"2024-04-15T16:27:34","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2024\/04\/15\/news-17957\/"},"modified":"2024-04-15T08:27:34","modified_gmt":"2024-04-15T16:27:34","slug":"news-17957","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2024\/04\/15\/news-17957\/","title":{"rendered":"The impact of compromised backups on ransomware outcomes"},"content":{"rendered":"

Credit to Author: Sally Adam| Date: Tue, 26 Mar 2024 09:42:37 +0000<\/strong><\/p>\n

\n
\"\"<\/a>
Click above to download the full report<\/figcaption><\/figure>\n

There are two main ways to recover encrypted data in a ransomware attack: restoring from backups and paying the ransom. Compromising an organization\u2019s backups enables adversaries to restrict their victim\u2019s ability to recover encrypted data and dial-up the pressure to pay the ransom.<\/p>\n

This analysis explores the impact of backup compromise on the business and operational outcomes of a ransomware attack. It also shines light on the frequency of successful backup compromise across a range of industries.<\/p>\n

The findings are based on a vendor-agnostic survey commissioned by Sophos of 2,974 IT\/cybersecurity professionals whose organizations had been hit by ransomware in the last year. Conducted by independent research agency Vanson Bourne in early 2024, the study reflects respondents\u2019 experiences over the previous 12 months.<\/p>\n

Executive summary<\/strong><\/h2>\n

The analysis makes clear that financial and operational implications of having backups compromised in a ransomware attack are immense. When attackers succeed in compromising backups, an organization is almost twice as likely to pay the ransom and incurs an overall recovery bill that is eight times higher than for those whose backups are not impacted.<\/p>\n

Detecting and stopping malicious actors before<\/em> your backups are compromised enables you to reduce considerably the impact of a ransomware attack on your organization. Investing in preventing backup compromise both elevates your ransomware resilience while also lowering the overall Total Cost of Ownership (TCO) of cybersecurity.<\/p>\n

Download the report PDF.<\/a><\/p>\n

Learning 1: Ransomware actors almost always attempt to compromise your backups <\/strong><\/h2>\n

94% of organizations hit by ransomware in the past year said that the cybercriminals attempted to compromise their backups during the attack. This rose to 99% in both state and local government, and the media, leisure and entertainment sector. The lowest rate of attempted compromise was reported by distribution and transport, however even here more than eight in ten (82%) organizations hit by ransomware said the attackers tried to access their backups.<\/p>\n

\"\"<\/a><\/p>\n

Learning 2: Backup compromise success rate varies greatly by industry<\/strong><\/h2>\n

Across all sectors, 57% of backup compromise attempts were successful, meaning that adversaries were able to impact the ransomware recovery operations of over half of their victims. Interestingly, the analysis revealed considerable variation in adversary success rate by sector:<\/p>\n