Ransomware payments globally surge by 500% in 2023

The 2024 report also found that 63% of ransom demands were for $1 million or more

The latest report from cybersecurity firm Sophos revealed that ransom payments by companies globally hit with ransomware increased by 500% in 2023.

According to the “State of Ransomware 2024”, organizations that paid the ransom reported an average payment of $2 million, up from $400,000 recorded in 2022.

It, however, noted that ransoms are just one part of the cost. Excluding ransoms, Sophos’ survey found the average price of recovery reached $2.73 million, an increase of almost $1 million from the $1.82 million that the company reported last year.

Sophos in the report, added that despite the soaring ransoms, this year’s survey indicates a slight reduction in the rate of ransomware attacks with 59% of organizations being hit, compared with 66% in 2022.

The 2024 report also found that 63% of ransom demands were for $1 million or more, with 30% of demands for over $5 million, suggesting ransomware operators are seeking huge payoffs.

Ransomware as dominant threat

Commenting on the report, the Chief Technical Officer of Sophos, John Shier, said: “We must not let the slight dip in attack rates give us a sense of complacency. Ransomware attacks are still the most dominant threat today and are fueling the cybercrime economy.

“Without ransomware, we would not see the same variety and volume of precursor threats and services that feed into these attacks. The skyrocketing costs of ransomware attacks belie the fact that this is an equal-opportunity crime.

“The ransomware landscape offers something for every cybercriminal, regardless of skill. While some groups are focused on multi-million-dollar ransoms, there are others that settle for lower sums by making it up in volume.”

Causes of attacks

The report further revealed that for the second year running, exploited vulnerabilities were the most commonly identified root cause of an attack, impacting 32% of organizations. This was closely followed by compromised credentials (29%) and malicious email (23%).

Sophos noted that this is directly in line with recent, in-the-field incident response findings from its most recent Active Adversary report.

“Victims…