Although ransomware attacks dropped globally by 36% to 317.6 million in 2023, the financial industry is still plagued by malicious software, according to new data.
According to data compiled by Stocklytics.com, almost 65% of financial organisations worldwide reported experiencing a ransomware attack in 2023, significantly more than just two years ago.
Ransomware attacks double in two years
Although a lot has changed since the WannaCry ransomware attack in May 2017, with companies and organisations taking various security measures and boosting their cyber security budgets, ransomware remains one of the leading types of cyberattacks globally.
Last year, ransomware made up nearly two-thirds of all reported cyber attacks, and most of them happened in the financial industry, one of the most targeted sectors.
The rise of new technologies, the emergence of ransomware marketplaces, and the easy availability of malware kits used to create new malware samples on demand have made the rate of ransomware attacks in the financial sector skyrocket in the past few years.
Sophos’s State of Ransomware in Financial Services 2023 survey showed just how significant that growth was.
Last year, nearly 65% of financial organisations reported experiencing ransomware, up from 55% in 2022 and almost double the 34% reported by the sector back in 2021. Although the industry experienced an increased attack rate, it was still below the cross-sector average of 66%.
Furthermore, financial services reported the highest encryption level in the last three years. In 2023, 81% of financial organisations stated their data were encrypted, way up from 54% reported a year before.
Statistics also showed that only one in ten attacks were stopped before the data was encrypted, the second lowest rate across all sectors included in the survey.
40% of attacked organisations paid ransoms of $1 Million or more
Exploited vulnerabilities and compromised credentials were the two most common causes of ransomware attacks in the financial services sector in 2023, with 40% and 23% shares, respectively. Phishing ranked as the third most common cause, with a 33% share in total attacks.
The survey also showed that while ransom payments dropped, the average payment amount skyrocketed. In 2023, 43% of financial services organisations paid the ransom to recover their encrypted data, down from 52% a year before.
However, the share of organisations paying higher ransoms has increased, with almost 40% of paying one million dollars or more, or eight times more than in 2022. At the same time, the share of organisations that paid less than $100,000 remained unchanged, coming in at around 40%.
