Report: 90% of companies affected by ransomware in 2022

An annual SpyCloud Research found that 90% of organizations have experienced ransomware in the past 12 months, an alarming increase from last year’s 72.5%.

To compile the 2022 Ransomware Defense Report, SpyCloud asked more than 300 individuals in active IT security roles at US, UK and Canadian organizations with at least 500 employees to evaluate the threat of ransomware, as well as their company’s cyber readiness, in the past 12 months.

Their insights show that while companies have strengthened their cybersecurity posture across the board in the face of the increased threat of ransomware, criminals are becoming more sophisticated and using security gaps to launch attacks.

Despite increased investments in cybersecurity, the relentless flood of ransomware has continued to disrupt operations over the past year and threaten organizations’ data. In addition, organizations were more likely than last year to be hit more than once: 50% were hit at least twice, 20.3% were hit between 6 and 10 times, and 7.4% were attacked more than 10 times.

The increasing prevalence of repetitive attacks is an indication that popular methods such as data backup — which respondents viewed as their main ransomware countermeasure — are still exposing sensitive data. Once an attack has taken place, retrieving lost data doesn’t stop attackers from sharing it on the dark web, allowing criminals to use it for future nefarious activities, including their next attack.

Malware hits security gaps

Malware-preparedness also represents a major gap in the defense of organizations. IT security teams face a near-total lack of understanding of malware infections on unattended devices used to access work applications or accounts. According to 87% of respondents, reports of malware stealing credentials, such as RedLine Stealer, have increased the focus on unattended personal devices as a potential entry point for ransomware.

Their concerns are valid: Malware infections are more common than businesses realize. By analyzing botnet logs recovered this year alone, SpyCloud researchers identified more than 6 million malware-infected devices with ported application credentials.

While the report indicates organizations are making progress toward better prevention — those that have implemented or plan to implement multi-factor authentication nearly doubled from 56% last year to 96% — the report’s findings show that of key gaps around exposed data and malware is critical to making a dent in the fight against ransomware.

Read the full report from SpyCloud.