Ransomware Statistics 2016 – 2017: A Scary Trend in Cyberattacks

February 27, 2017

6 min read

Tracy Rock

Director of Marketing @ Invenio IT

Ransomware Statistics 2016 – 2017: A Scary Trend in Cyberattacks

by | Feb 27, 2017

One of the most newsworthy ransomware statistics of 2016 came in April, when the Federal Bureau of Investigation warned that cybercriminals had already extorted $209 million from businesses within the first three months of the year.

This put ransomware on track to become a $1 billion crime in 2016 – a stat that was reported by countless news organizations, including CNN, NBC and the New York Times.

An online search for “ransomware statistics 2016” will direct you to that $1 billion figure every time. But this statistic only shows part of the picture. Ransomware is doing far greater damage to businesses.

When you factor in operational downtime after an attack, the increased staff resources needed to resolve the problem, and replacement of computer systems, ransomware is actually costing businesses more than $75 billion per year.

The bad news is: these numbers are only going to get worse in 2017 and beyond. But the good news is: technology providers are producing smarter, more effective solutions for combatting an attack.

A Closer Look: Ransomware Statistics 2016 – 2017

What were the most noteworthy Ransomware Statistics 2016, and what can we expect in the months ahead?

We’ve compiled a wide range of figures from across the industry, and the consensus is: ransomware isn’t going away any time soon. Take a look at these stats to see exactly where the trends are headed and how organizations have been impacted.

1) Ransomware emails spiked 6,000%

When you search “ransomware statistics 2016,” most stats focus on the trends of actual attacks – but what about the trend of attempts? Not surprisingly, those are skyrocketing, too.

A study by IBM Security found that the number of ransomware-infected emails increased 6,000 percent compared to 2015. Attackers are trying harder to infect users’ computers right through their inboxes. These emails generally have attachments disguised as invoices, statements, spreadsheets, faxes or personal notes.

Source: IBM via CNBC

2) 40% of all spam email had ransomware

The same IBM study found that almost 40 percent of all spam messages in 2016 contained ransomware. That’s nearly one out of every two spam emails infected with a ransomware virus that, if executed, could encrypt all data on the computer in a matter of seconds – as well as data on any shared drives or other computers on the network.

Source: IBM via CNBC

3) 59% of infections came from email

A 2016 study by Osterman Research found that email was by far the top delivery method for ransomware, accounting for 59 percent of infections.

31 percent of infections came via a link in an email that directed the user to a malicious website, while 28 percent came through an email attachment. Another 24 percent came through websites unassociated with an email. The remaining 17 percent of infections came from social media, storage drives, business applications, or the organizations simply weren’t sure how the ransomware got there.

Source: Osterman Research via Barkly

4) 92% of surveyed IT firms reported attacks on their clients

In 2016, data-protection company Datto surveyed 1,100 IT firms about their experience with ransomware. A whopping 92 percent of those companies said they had clients who were attacked within the last year.

Nearly 40 percent said that those attacks happened more recently: within just the last six months.

Source: Datto via The Atlantic

5) Infections hit 56,000 in a single month

In 2015, the rate of ransomware infections fluctuated between 23,000 and 35,000 per month. These numbers ballooned to 56,000 in March 2016.

Cybersecurity leader Symantec attributed the spike to the arrival of Locky – a specific form of ransomware virus that is now the most common type of infection. Locky is typically hidden in Microsoft Word files and executed through the use of macros.

Source: Symantec via Barkly

6) Attacks expected to double in 2017

2016 saw virtually four times as many ransomware attacks as in 2015, and these figures are projected to keep climbing. According to some estimates, the attacks will double in 2017.

The risk assessment experts at Beazley looked at nearly 2,000 separate data breeches across a wide range of companies. Their study concluded that, despite the staggering increase in attacks from 2015 to 2016, infections are projected to continue rising.

Source: Beazley via SC Magazine

7) Healthcare and Financial Services were the hardest hit

According to the research by Osterman, ransomware attacks were most common in the financial services and healthcare industries.

In its report, Osterman wrote, “The fact that healthcare and financial services were the most vulnerable to ransomware attacks comes as no surprise. These industries are among the most dependent on access to their business-critical information, which makes them prime targets for ransomware-producing criminals.”

Source: Osterman Research via Malwarebytes

8) 70% of businesses paid the ransom

U.S. law enforcement agencies strongly advise against paying the ransom, but the decision is difficult for many businesses. In many cases, businesses determine it is easier and more cost-efficient to pay up than to find other ways to resolve the problem (especially if they don’t have an adequate data backup system in place). That is exactly the predicament that attackers want.

So, it’s no surprise that the study by IBM Security found that 70 percent of business victims paid the ransom in 2016. Before you pay up after an attack, keep in mind that there’s no guarantee you’ll receive the decryption keys. And the FBI warns that many businesses who have paid the ransom were targeted again later.

Source: IBM via CNBC

9) 20% of businesses paid more than $40,000

This is one of the more startling ransomware statistics 2016: the ransom demands have been getting much higher.

In September of last year, a study by Datto found that the average ransomware demand ranged between $500 and $2,000. But many businesses are shelling out much more. Of those who paid, IBM found, 50 percent paid more than $10,000. One in every five victims was extorted for more than $40,000.

Source: IBM via CNBC

10) Less than 25% of ransomware attacks are reported

Most businesses remain tight-lipped after an attack, often because they don’t want to attract any negative exposure that could hurt the company’s reputation. This is especially true at healthcare and financial organizations, where protecting sensitive customer data is crucial. These businesses do not want to create the image that they’ve compromised customer information, even if they haven’t. And they especially don’t want to admit to having paid a ransom to cyber-attackers.

A study found that less than one in four incidents are reported to the authorities. It’s worth noting, however, that the FBI strongly advises businesses to contact their nearest FBI field office immediately after an attack has been detected.

Source: Datto via The Atlantic

11) Most businesses face at least 2 days of downtime

A major data loss can cripple operations in just seconds. And if businesses don’t have an adequate recovery plan in place, that downtime is likely to be extended for several days.

One analysis found that the majority of business victims experienced at least two days of downtime. This downtime can be extremely costly. Another group calculated that each hour of inactivity costs small companies an average of $8,581 per hour.

Source: Intermedia and Aberdeen Group via The Atlantic

Now, about that Good News …

Yes, there is a silver lining in all this. The threat of ransomware is forcing businesses to get serious about business continuity.

Organizations are reevaluating their cybersecurity and data-backup solutions to ensure they are properly prepared for an attack. Ransomware prevention is a two-pronged approach: 1) businesses must have dependable systems, protocols and training in place to help prevent the risk of an infection in the first place; and 2) businesses must know what they’ll do after an attack occurs, including how they’ll restore data and also how they’ll maintain operations in the meantime.

Prevention & Response

Experts have found that the only businesses who have been able to quickly resolve a ransomware attack close to 100 percent of the time are those who had dependable data recovery solutions in place.

And there are some promising new developments in this area that are already working.

“Backups are critical in ransomware recovery and response,” states the FBI. “If you are infected, a backup may be the best way to recover your critical data.”

However, many businesses are using outdated backup systems that are vulnerable to failure after a ransomware attack. One survey found that 58 percent of business victims were not able to fully restore their backups after an attack, due to “unmonitored and failed backups, loss of accessible backup drives that were also encrypted, and loss of between 1-24 hours of data from the last incremental backup snapshot.”

Early Detection & Data Rollback

Companies like Datto are addressing these issues by integrating ransomware protection into their data-backup technology. These solutions automatically detect and identify ransomware at the first sign of an attack and immediately notify administrators to revert to a healthy backup. This significantly shortens the downtime and also eliminates the need to pay the ransom.

But remember, this is just one layer of the protection needed at most businesses. Staff education is critical to ensuring good security practices throughout the organization. Anti-malware software and proper network configurations, such as user access controls, are also essential.

Get More Information

For more information on ransomware protections solutions for your organization, contact the business continuity experts at Invenio IT. Visit www.invenioIT.com, call (646) 395-1170 or email us at success@invenioIT.com.

New call-to-action

Director of Marketing @ Invenio IT