Ransomware attacks have been omnipresent since 2020 and are wreaking havoc on businesses worldwide! To such an extent that the insurability of this type of incident is coming under serious pressure.
The number of ransomware attacks has increased by 225% since 2020! Every 11 seconds, a new ransomware attack is launched...and unfortunately, often with great success. The impact on the economy is already disastrous and is expected to reach a staggering $20 billion by the end of 2021!
What is a ransomware attack?
Ransomware is malicious software that allows hackers to lock all files on the corporate network. Criminals demand a certain amount of money (ransom) from the affected companies in the form of crypto-currencies such as Bitcoin in exchange for the decryption key.
The true cost of a ransomware attack
A large-scale (worldwide) study by Cybereason shows that most organisations give up when hit by a ransomware attack. Entrepreneurs are ofte nieve in their risk assessment and wrongly believe that they can get away with paying a few Bitcoins. The truth is different, as the above-mentioned research shows. Because the real business impact for the affected companies turned out to be much more extensive:
- 66% report significant revenue loss after a ransomware attack
- It's not just a few bitcoins: for 35% of the companies that paid the ransom, the amount involved was between $350,000 and $1.4 million. 7% of affected companies paid even more
- 53% of affected companies experienced reputational damage
- About 1 in 3 affected businesses saw top-level employees (so-called C-level management) leave as a direct result of the ransomware attack
- 29% had to dismiss employees due to the financial impact of the ransomware
- 26% of affected companies had their business operations at a standstill for a period of time
The ransomware dilemma: Pay the ransom or not?
When a ransomware attack has brought your company to a complete standstill, the temptation is great to opt for the -at first sight- easiest and fastest escape route: paying the ransom.
But is this a smart choice? After all, you are sponsoring a criminal network/ecosystem. Moreover, the chance of a successful outcome is highly uncertain:
- Will the attackers keep their part of the bargain and give access to all the data?
- What if that data is corrupted in the process?
- Will my company end up on some kind of 'payer list' on the dark web, thus attracting other criminals as well?
Research by Cybereason shows that 80% of all companies that paid the ransom were attacked again afterwards!
So then you should not pay it?
The question is whether you actually have that choice. Too often, when faced with a cyber incident, companies have their backs against the proverbial wall.... and have to pay a ransom simply because there is no alternative. Which brings us to the real problem...the proverbial 'Elephant in the room': too often, a solid, well thought-out and therefore usable business continuity plan is totally absent!
Paying no ransom is only an option if you have arranged an alternative way out for your company. That is exactly what such a business continuity plan is about. When drawing up such a plan, you think concretely about your internal organisation, about backup procedures (RPO and RTO), about your security policy, you provide clear responsibilities, robust procedures, you examine and evaluate your contracts with suppliers, your cloud risk, etc.
How CyberContact helps you
With the free online cyber test, we will help you get started and hold up a mirror to your business. We assess how mature your organisation is in terms of 10 essential policy points, and evaluate the relevance of 10 concrete preventative actions. And we estimate which insurance safeguards are most relevant to your company.
Because even if your business continuity plan is robust and you invest heavily in prevention....nothing and nobody is 100% safe. That is why cyber insurance is the logical conclusion to any cyber security policy.
CyberContract offers customers in all insurance formulas a unique '24/7 Active Hotline' support. In this way we contribute to immediate action when a customer fears to have been affected by a cyber incident. We guarantee the availability of essential niche IT knowledge (forensic IT specialists from CRONOS Security) and, through master Johan Vandendriessche of the AFFLUO office, also provide the necessary legal support.
Useful tips and links
For more information about this investigation, we refer to this article on the site of Cybercrimeinfo.
Looking for a solid cyber insurance policy? Calculate your premium here or contact one of our more than 100 partner brokers for advice!
