Ransomware Remains a Major Threat to Energy – Source: www.databreachtoday.com

Critical Infrastructure Security
,
Fraud Management & Cybercrime
,
Ransomware

Median Ransomware Attack Recovery Cost for Critical Infrastructure Is 4X Higher

Chester Wisniewski

•
July 19, 2024    

Ransomware remains a major threat to energy, oil/gas and utilities organizations of all sizes around the globe. Our latest report, The State of Ransomware in Critical Infrastructure 2024, reveals that the median recovery costs for two critical infrastructure sectors, energy and water, quadrupled to $3 million over the past year. This is four times higher than the global cross-sector median. In addition, 49% of ransomware attacks against these two critical infrastructure sectors started with an exploited vulnerability.

See Also: 5 Requirements for Modern DLP

Data for the report comes from 275 respondents at energy, oil and gas, and utilities organizations, which fall under the Energy and Water sectors of the U.S. Cybersecurity and Infrastructure Security Agency’s 16 defined critical infrastructure sectors. The results for this sector survey report are part of a broader, vendor-agnostic survey of 5,000 cybersecurity/IT leaders conducted between January and February 2024 across 14 countries and 15 industry sectors.

Criminals focus where they can cause the most pain and disruption so the public will demand quick resolutions and – they hope – ransom payments to restore services more quickly. This makes utilities prime targets for ransomware attacks. Because of the essential functions they provide, modern society demands they recover quickly and with minimal disruption.

Unfortunately, public utilities are not only attractive targets but are vulnerable to attacks on many fronts, including the requirement for high availability and safety, as well as an engineering mindset focused on physical security. There’s a preponderance of older technologies configured to enable remote management without modern security controls such as encryption and multifactor authentication. Like hospitals and schools, these utilities frequently operate with minimal staffing and without the IT staffing required to stay on top of patching, the latest security vulnerabilities and the monitoring required for early detection and response.

On top of growing recovery costs, the median ransom payment for organizations in energy and water sectors jumped to more than $2.5 million in 2024 – $500,000 higher than the global cross-sector median. The energy and water sectors also reported the second-highest rate of ransomware attacks. Overall, 67% of the organizations in these sectors reported being hit by ransomware in 2024, in comparison to the global, cross-sector average of 59%.

Other findings from the report include:

• The energy and water sectors reported increasingly longer recovery times. Only 20% of organizations hit by ransomware were able to recover within a week or less in 2024, compared to 41% in 2023 and 50% in 2022. Fifty-five percent took more than a month to recover, up from 36% in 2023. In comparison, across all sectors, only 35% of companies took more than a month to recover.
• The energy and water sectors reported the highest rate of backup compromise – 79% – and the third-highest rate of successful encryption – 80% – when compared to the other industries surveyed.

This shows that paying ransoms almost always works against our best interests. An increasing number – 61% – paid the ransom as part of their recovery, yet the amount of time it took to recover was extended. Not only do these high rates and amounts of ransoms encourage more attacks on the sector, but they do not achieve the claimed goal of shorter recovery times.

These utilities must recognize they are being targeted and take proactive action to monitor their exposed remote access and network devices for vulnerabilities and ensure they have 24/7 monitoring and response capabilities to minimize outages and shorten recovery times. Incident response plans should be planned in advance, as they are for fires, floods, severe storms and earthquakes, and they must be rehearsed on a regular schedule.

Read the full report, The State of Ransomware in Critical Infrastructure 2024.