Retail industry, second most targeted by ransomware: Sophos

• Some 77% of retail organisations hit globally, a 75% increase from 2020
• Average ransom payment was US$226,044, a 53% increase from 2020 

S

The retail industry had the second highest rate of ransomware attacks last year of all sectors surveyed after the media, leisure, and entertainment industry, according to a new study by Sophos. 

In a statement, the report titled "The State of Ransomware in Retail 2022" polled 5,600 IT professionals in mid-sized organisations across 31 countries, including 422 respondents from the retail sector.

It added that globally, 77% of retail organisations surveyed were hit, a 75% increase from 2020.  

This is also 11% more than the cross-sector average attack rate of 66%, Sophos said.

Chester Wisniewski, principal research scientist, Sophos said retailers continue to suffer one of the highest rates of ransomware attacks of any industry. 

“With more than three in four suffering an attack in 2021, it certainly brings a ransomware incident into the category of when, not if,” he said.

“In Sophos’ experience, the organisations that are successfully defending against these attacks are not just using layered defenses, they are augmenting security with humans trained to monitor for breaches and actively hunting down threats that bypass the perimeter before they can detonate into even bigger problems,” Wisniewski said. 

He added that this year’s survey showed that only 28% of retail organisations targeted were able to stop their data from being encrypted. 

“This suggests that a large portion of the industry needs to improve their security posture with the right tools and appropriately trained security experts to help manage their efforts,” he said.

As the percentage of retail organisations attacked by ransomware increased, so did the average ransom payment, Sophos said.

In 2021, the average ransom payment was US$226,044 (RM1 billion), a 53% increase when compared to 2020 $147,811 (RM665,000). However, this was less than one-third the cross-sector average $812K (RM3.6 million).

[RM1 = US$0.222]

According to Wisniewski, it is likely that different threat groups are hitting different industries. 

“Some of the low-skill ransomware groups ask for US$50,000 to US$200,000 in ransom payments, whereas the larger, more sophisticated attackers with increased visibility demand $1 million or more,” he said. 

“With Initial Access Brokers and Ransomware-as-a-Service, it’s unfortunately easy for bottom-rung cybercriminals to buy network access and a ransomware kit to launch an attack without much effort,” he added. 

“Individual retail stores and small chains are more likely to be targeted by these smaller opportunistic attackers,” Wisniewski said.

Additional findings include:

• While the retail sector was the second most targeted industry, the perceived increase in the volume and complexity of cyberattacks against the industry were slightly below the cross-sector average (55% and 55% respectively);
• Ninety two per cent of retail organisations hit by ransomware said the attack impacted their ability to operate and 89% said the attack caused their organisation to lose business/revenue;
• In 2021, the overall cost to retail organizations to remediate a ransomware attack was US$1.27 million, down from US$1.97 million in 2020; and
• When compared to 2020, the amount of data recovered after paying the ransom decreased (from 67% to 62%), as did the percentage of retail organisations that got all their data back (from 9% to 5%).

Click here to download the State of Ransomware in Retail 2022.