2021 Ransomware Statistics, Data, & Trends

The Growing Threat Of Ransomware

Ransomware is a type of malicious software that threatens you with harm, usually by denying you access to your data. The attacker demands a ransom from the victim, with the promise to restore access to the data upon payment.

• Ransomware has become a popular form of attack in recent years growing 350% in 2018.
• Ransomware detections are on the rise with Ryuk detections increasing by 543% over Q4 2018, and since its introduction in May 2019,
• 81% of cyber security experts believe there will be more ransomware attacks than ever in 2019.
• In 2019 ransomware from phishing emails increased 109% over 2017.
• 21% of ransomware involved social actions, such as phishing.
• New ransomware variants grew 46% in 2019.
• 68,000 new ransomware Trojans for mobile were detected in 2019.
• Ransomware attacks increased 41% in 2019 with 205,000 businesses who lost access to their files.
• It’s estimated that a business will fall victim to a ransomware attack every 14 seconds.
• From 2013 to 2016, the primary ransomware variants reported were CryptoLocker and CryptoWall.
• In 2017 and 2018, that transitioned to WannaCry and SamSam.
• In late 2018 and early 2019, the primary ransomware families have been GandCrab and Ryuk.

One reason for this growth is the appearance of ransomware as a service and ransomware kits on the dark web, which can be purchased for as low as $175 and require little to no technical knowledge to deploy.

Small businesses, which account for 43% of all cyber attacks, make for the perfect target as they often can’t afford the investments into security.

Large businesses and government institutions are also at risk. For example, the WannaCry ransomware attack was responsible for one of the largest healthcare breaches affecting the National Health Service (NHS) – locking out access to hundredes of thousands of patient files in hospitals in England and Scotland

Given this threat, the FBI has released and proposed ways to protect businesses from ransomware attacks.

For example, the FBI recommends the following steps to protect your network from ransomware including:

• Immediately secure backup data or systems by taking them offline.
• Contact law enforcement immediately.
• Collect and secure partial portions of the ransomed data that might exist.
• Change all online account passwords and network passwords after removing the system form the network.
• Delete Registry values and files to stop the program from loading.

Want to learn more? Check out the full list of ransomware stats below.

• The estimated cost of ransomware attacks:
  • 2020 – $20 billion
  • 2019 – $11.5 billion
  • 2018 – $8 billion

• The average ransom payment amount increased by 104% in Q4 2019 – $84,116, $780,000 for a large enterprise.
• Downtime increased by 200% year over year, and that such costs are “23X greater than the average ransom requested in 2019.
• The NotPeyta ransomware attack losses could exceed $1 billion.
• FedEx lost an estimated $300 million in Q1 2017 from the NotPetya ransomware attack.
• The average cost of a ransomware attack on businesses was $133,000.
• The average cost of ransom per incident is on the rise:
  • 2018 – $4,300
  • 2019 – $5,900
  • 2020 – $8,100
• The average cost of ransomware caused downtime per incident:
  • 2018 – $46,800
  • 2019 – $141,000
  • 2020 – $283,000
• Businesses lost around $8,500 per hour due to ransomware-induced downtime.
• Ransomware attacks cost U.S. healthcare organizations $157 million since 2016
• The individual ransom of 1,400 clinics, hospitals, and other healthcare organizations varied from $1,600 to $14 million per attack.

Industries Targeted By Ransomware

• Industries in North America reporting ransom attacks in 2019:
  • Government – 15.4%
  • Manufacturing – 13.9%
  • Construction – 13.2%
  • Utilities – 11.1%
  • Professional services – 10.4%
  • Retail – 7.5%
  • Real estate – 7.1%
  • Hospitality – 6.1%
  • Healthcare – 5.7%
  • Education – 5%
  • Financial institutions – 4.6%

Small & Medium Businesses

• 20% of ransomware victims are small to mid-sized businesses.
• 85% of MSPs report ransomware as a common threat to small to mid-sized businesses.
• 29% of small businesses had experience with ransomware, making them more likely to be unprepared for the threat.
• The average size company of a ransomware attack in 2019 was 645 employees.

City & Local Government

• At least 948 government entities in the United States were attacked by ransomware hackers extorting money in 2019.
• Ransomware attacks against state and local governments were the top cybersecurity industry story in 2019.
• Ransomware attacks against municipalities increased 60% in 2019.
• 48 of the 50 U.S. states, as well as the District of Columbia, experienced at least one ransomware attack from 2013 to 2018.
• Of those municipal victims, communities of fewer than 50,000 residents accounted for 45% of the ransomware activity, while 24% had fewer than 15,000.
• 16% of the municipalities targeted had populations of more than 300,000.
• 17% of state and local government entities that were hit paid the ransom
• While 2018 saw a small resurgence in overall ransomware attacks compared to 2017, there was a sharp jump in ransomware attacks against state and local governments, and that trend appears to continue into 2020 and beyond.
• Ransomware attacks against state and local governments were the top cybersecurity industry story in 2019.

Healthcare

• Ransomware attacks on the healthcare sector will quadruple by 2020.
• More than 700 healthcare providers fell victim to a ransomware attack in 2019.
• Almost half of the ransomware incidents reported in 2018 involved healthcare companies.
• 23% of healthcare organizations paid some form of payment to the attackers.
• On the dark web, an individual healthcare record goes for close to $400, which is 2.5 times the average overall industries.
• Of the 2,600 incidents reported, 36% were malware related followed by accidental disclosure in 26% of the cases.
• 90% of healthcare organizations saw an increase in ransomware infection rates from 2017 to 2018.
• 18% of healthcare devices have been the target of malware.
• A report by CSO online estimates healthcare related malware attacks will likely quadruple by 2020.
• 50% of IT professionals believe their industry simply isn’t ready to handle the threat of ransomware or other cyber security threats.
• 45% of all ransomware attacks in 2017 involved healthcare organizations.
• It’s estimated that in 2019 healthcare organizations fell victim to a ransomware attack every 14 seconds.
• On average, it takes 300 days for a healthcare organization to discover that it had suffered a breach.
• 77% of successful ransomware attacks were from fileless techniques that completely bypassed the victim company’s antivirus.
• 20% of healthcare domain emails were identified as fraudulent in 2017.
• 40 million ransomware attacks were detected using malicious URLs or attachments against healthcare providers in 2017.

Financial Institutes

• 90% of all financial institutions have experienced ransomware in the past year.
• More than 204,448 users experienced an attempt to log their banking information.
• Ransomware is a rising threat to small banks and credit unions with less than $35 million in annual revenue.
• Of the 52% of attacks targeting the financial services sector in March 2020, 70.9% of those came from the Kryptik trojan.

Education

• Education organizations were the biggest targets of ransomware attacks in 2019, claiming 61% of reported attacks.
• At least 28 universities, colleges and school districts were impacted in Q1 2019, disrupting operations at up to 422 individual schools.
• In 2019, 89 educational establishments were impacted by ransomware disrupting operations at up to 1,233 individual schools.

Mining And Metals

• 54% of mining and metals companies suffered a significant cyber security incident in 2019.
• 40 percent of mining and metals companies had experienced a rise in external threats over the previous 12 months.
• 96% of attacks on mines are for intelligence gathering.
• Investments into cyber security initiatives by mining and metals companies has increased by 53% in 2019.
• 97% of organizations say their current cuber security function does not fully meet their organization’s needs.
• 38% of email users in the mining industry were hit with a malicious email in the last year.
• The average annual cost of cybercrime to a Canadian company was over $12 million in 2018.
• 48% of industry professionals say that it is unlikely that they would even be able to distinguish and identify a sophisticated attack.

Utilities And Infrastructure

• Early 2020 observes a 32% increase in ransomware attacks against energy/utilities organizations.
• Less than 60% of respondents “believe their organization is in or approaching compliance with government cybersecurity mandates.”
• The global market for energy IT and cybersecurity software and services will surpass $19 billion in 2020 and reach more than $32 billion in 2028.

Mobile Ransomware Statistics

• Threats in the mobile space continue to grow year-over-year, including the number of new mobile malware variants which increased by 54% in 2019.
• There are more than 4,000 mobile threat families and variants in the McAfee sample database today.
• More than 18 million mobile malware instances were detected by Symantec in 2018.
• In 2018, over 8,000 mobile banking ransomware Trojan installations were detected.
• 60,176 new mobile ransomware Trojans were discovered in 2018.
• Less than 20% of mobile malware is delivered via a browser — the remainder of the payloads come through an app.
• More than 4.2 million American mobile users suffered ransomware attacks on their phones.
• Android/LokiBot has targeted more than 100 financial institutions around the world generating close to $2 million in revenue from kit sales on the “dark web.”

Cryptocurrency Ransomware Statistics

• 95% of ransomware profits went through the cryptocurrency trading platform BTC-e.
• 60% of cryptocurrency transactions can be traced back to individuals.
• The number of mobile miners has increased by almost 45% from 2016–2017 to 2017–2018.

General Ransomware Statistics

• 50% of a surveyed 582 information security professionals do not believe their organization is prepared to repel a ransomware attack.
• 75% of companies infected with ransomware were running up-to-date endpoint protection.
• A survey of 1,100 IT professionals say 90% had clients that suffered ransomware attacks in the past year.
• 25% of business executives would be willing to pay between $20,000 and $50,000 to regain access to encrypted data.
• Most common types of ransomware attacks:
  • CryptoLocker – 66%
  • WannaCry – 49%
  • CryptoWall – 34%
  • Locky – 24%
  • Petya – 17%
  • CryptXXX – 14%
  • notPetya – 12%
• The most common systems targeted by ransomware are:
  • Windows – 85%
  • MacOS – 7%
  • Android – 5%
  • iOS – 3%
• The most common methods of deploying ransomware include:
  • Spam / phishing emails – 67%
  • Lack of cyber security training – 36%
  • Weak passwords / access management – 30%
  • Poor user practices / gullibility – 25%
  • Malicious websites / web ads – 16%
  • Other – 16%
• 30% of organizations who pay the ransom receive all of their money back.
• 40% of ransomware victims paid the ransom.
• More than 50% of ransoms were paid by bitcoin in 2018.
• 10% of all ransom demands are over $5,000.
• Of the 1,100 IT professionals surveyed, 90% had clients that suffered ransomware attacks in the past year.
• 40% had clients that were subject to at least 6 ransomware attacks.
• A new organization will fall victim to ransomware every 14 seconds in 2019, and every 11 seconds by 2021.
• 1.5 million new phishing sites are created every month.
• Number of organizations that reported a ransomware attack in 2019 by country:
  • Saudi Arabia – 88%
  • Turkey – 74%
  • China – 69%
  • Spain – 66%
  • South Africa – 66%
  • Mexico – 61%
  • Italy – 58%
  • UK – 57%
  • US – 54%
  • Germany – 51%
  • Canada – 46%
  • France – 44%
  • Australia – 40%
  • Japan – 38%
• Countries with highest share of users attacked with ransomware
  • Thailand – 9.57%
  • United Arab Emirates – 8.67%
  • Iran – 8.4%
  • Bangladesh – 7.62%
  • Vietnam – 6.17%
  • Saudi Arabia – 5.45%
  • China – 5.36%
  • India – 4.28%
  • Algeria – 3.59%
  • Turkey – 3.22%

Recent Ransomware Attacks

Education

• Spartanburg County School District (2020) – Spartanburg Country School District was the victim of a ransomware attack on February 26th. As a result, internet connectivity and network access was shut off for three days. Although no data was compromised, the district did lose all online access.
• Gadsden Independent School District (2019) – Gadsden Independent Schools was a victim of the Ryuk ransomware virus, which affected more than 10,000 computers districtwide. The point of infection was likely the result of a phishing email.
• Multiple Texas School Districts (2017) – School districts in the north and northeast Texas were exposed to a data breach. The impact of the breach estimates that personal information of 700 students across 39 districts could have been leaked as a result of an employee’s state-issued laptop being infected.

Healthcare

• Universal Health Services (2020) – UHS reports an information technology security incident. Malware, specifically the Ryuk ransomware, which targeted 400 hospitals in the US and the UK. UHS has over 90,000 employees who provide healthcare services to roughly 3.5 million patients every year.
• Duesseldorf University Hospital (2020) –  A German hospital is infected with ransomware, resulting in the first death reported following a ransomware attack.
• LifeBridge Health (2018) – Baltimore-based healthcare system suffered a potential data breach of 500,000 patients. Investigations showed that the hackers first gained access to the system back in September 2016.
• Health Management Concepts (2018) –  Full-blown data breach where threat actors gained access to files containing the personal data of over 500,000 patients.
• CNO Financial Group (2018) – Between May and September of last year, hackers gained access to the credentials of CNO employees. This information was then used to access company websites, compromising the data of over 566,000 policyholders and applicants. Data accessed included dates of birth, insurance details, and partial Social Security numbers.
• UnityPoint Health (2018) – UnityPoint suffered two security breaches last year. The second compromised the data of 1.4 million patients. A series of phishing emails had been made to look like they were from a top executive within the company. When an employee fell for the scam, it gave hackers access to private email accounts.
• AccuDoc (2018) – The data breach of billing vendor AccuDoc was the biggest of last year. The North Carolina-based vendor prepares patient bills while managing Atrium Health’s billing system. The investigation revealed that while hackers could view the data, they were unable to extract it.

City & Local Government

• Tillamook County (2020) – Commissioners negotiate for an encryption key to regain control of the government’s computer systems after falling victim to a ransomware attack.
• 22 Small Cities & Towns In Texas (2019) – Researchers potentially identify a “new type” of cyberattack, where a coordinated operation of distributed ransomware attacks are linked to a single actor.
• Atlanta, Georgia (2018) – After falling victim to the SamSam malware, the city of Atlanta, Georgia refused to pay the $50,000 ransom and instead spent more than $5 million rebuilding its computer network.
• Swansea Police Department (2013) – One of the first known ransomware attacks against a local government agency was a CryptoLocker virus, resulting in a $750 ransom.

Mining And Metals

• Nyrstar (2019) – Nyrstar, a Belgium based company that produces processed metals such as Zinc and Lead for commercial use was the victim of a ransomware attack.
• Norsk Hydro (2019) – Norsk Hyrdo, one of the largest aluminum producers in the world temporarily stopped production at several plants as a result of the LockerGoga Ransomware.

Transportation

• Toll Group (2020) – Australian Transportation and logistics company, Toll Group, was hit by a variant of the Mailto ransomware. The incident brought down a number of the company’s IT systems, causing significant delivery delays and affecting freight volumes.
• Texas Department of Transportation (2020) – The Texas Government suffered two ransomware attacks within a few weeks infecting systems at the state’s Department of Transportation (TxDOT).
• Maersk (2017) – The Danish transportation and logistics company, Maersk, $300M of business interruption losses due to a ransomware attack. The NonPetya ransomware forced Maersk to reinstall 4000 servers, 45000 PCs, and 2500 applications over 10 days.

Preventing Ransomware Attacks

By the time the ransom message pops up on a machine, it is too late to save the system. That’s why it’s important to take steps in advance to prevent a ransomware attack from occurring in the first place including:

• Education and training
• Automated backups
• Minimize attack surfaces
• Create an incident response plan
• Endpoint monitoring and protection
• Ransomware insurance