A cybersecurity firm, Sophos has informed that hackers have intensified attacks on two critical sectors of the economy with median recovery cost quadrupled to $3 million over the past year.
The sectors, which are energy and water, Sophos disclosed that the recovery cost is four times higher than the global cross-sector median. It added that 49 percent of ransomware attacks against these two critical infrastructure sectors started with an exploited vulnerability.
The cyber security firm noted that the results for this sector survey are part of a broader, vendor-agnostic survey of 5,000 cybersecurity/IT leaders conducted between January and February 2024 across 14 countries and 15 industry sectors.
Global Field Chief Technical Officer, Sophos, Chester Wisniewski, said: “Criminals focus where they can cause the most pain and disruption so the public will demand quick resolutions, and they hope, ransom payments to restore services more quickly. This makes utilities prime targets for ransomware attacks. Because of the essential functions they provide, modern society demands they recover quickly and with minimal disruption.
“Unfortunately, public utilities are not only attractive targets but vulnerable to attacks on many fronts, including the requirement for high availability and safety, as well as an engineering mindset focused on physical security. There’s a preponderance of older technologies configured to enable remote management without modern security controls like encryption and multifactor authentication. Like hospitals and schools, these utilities are frequently operating with minimal staffing and without the IT staffing required to stay on top of patching, the latest security vulnerabilities and the monitoring required for early detection and response.”
On top of growing recovery costs, the median ransom payment for organisations in these two sectors jumped to more than $2.5 million in 2024—$500,0000 higher than the global cross-sector median.
The Energy and Water sectors also reported the second-highest rate of ransomware attacks. Overall, 67 per cent of the organisations in these sectors reported being hit by ransomware in 2024, in comparison to the global, cross-sector average of 59 per cent.
Other findings from the report include that the energy and water sectors reported increasingly longer recovery times. According to the report, only 20 per cent of organisations hit by ransomware were able to recover within a week or less in 2024, compared to 41 per cent in 2023 and 50 per cent in 2022. It disclosed that 55 per cent took more than a month to recover, up from 36 per cent in 2023. In comparison, across all sectors, only 35 per cent of companies took more than a month to recover.
Source: Guardian