Retail firms’ ability to halt ransomware attacks in 3-year decline

The ability of retail organisations to halt ransomware attacks has declined the most in three years, according to a new report from Sophos.

The State of Ransomware in Retail 2023 report found that 26 percent of retail organisations in 2022 were able to disrupt a ransomware attack before their data was encrypted. This represents a three-year low for the sector from 34 percent and 28 percent in 2021 and 2022 respectively.

Read also: Cyber attacks on healthcare companies rise most in 3 years

Chester Wisniewski, director, global field CTO, Sophos, said ransomware criminals have been encrypting increasingly greater percentages of their retail victims in the last three years, as shown by the steadily declining rate of retailers stopping cybercriminal attacks in progress. This indicates that retailers need to improve their defensive game by setting up security that detects and responds to intrusions earlier in the attack chain.

The report also found that retail organisations that paid ransom saw their median recovery costs (not including the ransom payment) were four times the recovery costs of those that used backups to recover their data ($3m vs $750,000).

“Forty-three percent of retail victims paid the ransom according to our survey respondents, yet the median recovery costs to victims who paid the ransom was four times the cost to those who used backups and other recovery methods. There are no shortcuts in these situations and rebuilding systems is almost always required. It’s better to deprive the criminals of their spoils and build back better,” said Wisniewski.

In a cross-sector trend, the report found that the retail sector experienced its highest rate of encryption over the past three years, with 71 percent of those organisations targeted by ransomware saying that attackers successfully encrypted their data.

Also, the percentage of retail organisations attacked by ransomware declined from 77 percent last year to 69 percent this year. At the same time, the percentage of retail organisations that recovered in less than a day decreased from 1 percent to 9 percent this year, while the percentage of retail organisations that took more than a month to recover increased from 17 percent to 21 percent.

Read also: Growing Cyberattacks put innovative companies at greater risk Michael Arov

Sophos says there is a need for companies to strengthen defensive shields with security tools that defend against the most common attack vectors, including endpoint protection with strong anti-ransomware and anti-exploit capabilities. There is also a need for 24/7 threat detection, investigation and response, whether delivered in-house or by a specialised Managed Detection and Response (MDR) provider and optimising attack preparation, including regularly backing up, practicing recovering data from backups and maintaining an up-to-date incident response plan.