Ransomware is not enough -- 83 percent of attacks now feature other extortion tactics

Ransomware itself is bad enough, but 83 percent of successful ransomware attacks now include alternative extortion methods according to a survey by machine identity company Venafi.

Popular techniques include using the stolen data to extort customers (38 percent), exposing data on the dark web (35 percent), and informing customers that their data has been stolen (32 percent).

Only 17 percent of successful attacks just asked for a ransom in return for a decryption key, meaning that many new forms of extortion are now more common than traditional methods.

The data also shows that in many cases these alternative extortions are happening even after a ransom has been paid. Almost a fifth (18 percent) of victims paid the ransom but still had their data exposed on the dark web, while 16 percent refused to pay the ransom and had their data exposed. Eight percent of companies refused to pay the ransom leading to the attackers trying to extort their customers, while 35 percent of victims paid the ransom but were still unable to retrieve their data.

"Ransomware attacks have become much more dangerous. They have evolved beyond basic security defenses and business continuity techniques like next-gen antivirus and backups," says Kevin Bocek, vice president of business development and threat intelligence at Venafi. "Organizations are unprepared to defend against ransomware that exfiltrates data, so they pay the ransom, but this only motivates attackers to seek more. The bad news is that attackers are following through on extortion threats, even after the ransom has been paid! This means CISOs are under much more pressure because a successful attack is much more likely to create a full-scale service disruption that affects customers."

Overall 71 percent of the 600 IT decision makers polled believe that double and triple extortion has grown in popularity over the last 12 months, and 65 percent agree that these new threats make it much harder to say no to ransom demands. It's not surprising then that 72 percent agree that ransomware attacks are evolving faster than the security controls needed to protect against them, and 74 percent agree that ransomware should now be considered a matter of national security.

You can find out more on the Venafi blog.

Image credit: Anidimi/depositphotos.com