78% of attack victims paid ransom and three quarters suffered multiple strikes

Semperis has published the results of its global ransomware study of nearly 1,000 IT and security professionals at organisations spanning multiple industries across the US, UK, France, and Germany. The study aims to understand the prevalence, frequency and costs of ransomware attacks—in both ransom payments and collateral damage.

The results highlight an alarming trend toward multiple, sometimes simultaneous attacks, forcing business leaders to re-evaluate their cyber resilience strategies to address common points of failure, including inadequate identity system backup and recovery practices.

“Considering that there is a 24/7 threat arrayed against today’s organisations, you can never say ‘I am safe’ or take a moment off. The best you can do is to make your environment defensible and then defend it,” said Chris Inglis, Semperis Strategic Advisor and first U.S. National Cyber Director. “At the centre of this whole discussion is business viability. Attackers are trying to hold that at risk so that they can then convince you to buy them out. If they can achieve a successful attack on identity, then they own privilege, and they can then use that privilege to their benefit.”

The study was conducted by Semperis in the first half of 2024. Key findings:

Ransomware attacks are not a one-time threat: Overall, 74% of respondents that were attacked for ransom in the past 12 months were attacked multiple times—many within the span of a week. In the UK, 83% of organisations that were attacked were targeted more than once.

Companies are not prepared to beat ransomware: 78% of targeted organisations paid the ransom. In the UK, 73% paid multiple times, and 38% of those paid ransom four times or more.

Few companies see an alternative to ransom payment: 87% of attacks caused business disruption—even for those that paid ransom—including data loss and the need to take systems offline. For 16% of respondents, the attack created a life-or-death dilemma. In the UK, 14% of respondents said it was a matter of life and death.

Paying ransom does not guarantee a return to normal business operations: 35% of victims who paid ransom either did not receive decryption keys or received corrupted keys. (UK: 43%)

Recovery Time Objectives (RTOs) are not being met: 49% of respondents (UK: 51%) needed 1 to 7 days to recover business operations to minimal IT functionality after a ransomware attack, and 12% (UK: 13%) needed 7 days or more.

Few companies maintain comprehensive, dedicated identity protection

Although 72% of UK respondents said they had an identity recovery plan, signalling strong progress towards IAM-centric security, only 32% reported having dedicated, AD-specific backup systems. Without AD-specific, malware-free backups and a tested, cyber-specific recovery plan, recovery will be prolonged, increasing the chance that the organisation will decide to pay ransom to restore business operations.

“For management and the Board to make an educated decision not to pay ransom, they need to know how long recovery will take and have confidence in the process. That means you must test your plan in as close to a real-world scenario as possible and present it to the Board before an attack occurs. That way, when disaster strikes, decision makers will have been confident in their ability to say ‘no’ to attackers,” said Mickey Bresman, CEO, Semperis.

Of the ongoing cybersecurity challenges organisations cited, lack of support from the Board of Directors topped the list. Other concerns included budget constraints, staffing shortages, outdated systems and cybersecurity regulations and directives.

“Technology can help us analyse and assess what's happening, moment by moment,” Inglis said. “It can help us respond more quickly and recover more quickly. But the thing that is most wanting now is a collective realisation that we all have a part to play. That starts with the Board, not with the IT shop. The Board is accountable; the SEC has made that clear. Regulations are increasingly making it clear: cybersecurity is a business issue.”