nordlocker.com
Open in
urlscan Pro
2606:4700::6812:aec
Public Scan
Submitted URL: https://u7061146.ct.sendgrid.net/ls/click?upn=4tNED-2FM8iDZJQyQ53jATUYDnhe-2B7x-2ByRMIfEvIPuRWB6DXPvMO8WmzdUjTG2c5dng54EEoNvTDQ6u...
Effective URL: https://nordlocker.com/ransomware-attack-statistics/
Submission: On December 02 via manual from DE — Scanned from DE
Effective URL: https://nordlocker.com/ransomware-attack-statistics/
Submission: On December 02 via manual from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form novalidate="">
<div class="mb-4"><span class="nord-input__wrapper relative inline-block w-full"><input type="text"
class="nord-input border rounded-1 w-full align-bottom leading-normal outline-none appearance-none nord-input--small text-small px-3 py-2 text-grey-darkest border-grey-light" id="name" name="name" value="" placeholder="Full name"></span>
</div>
<div class="mb-4"><span class="nord-input__wrapper relative inline-block w-full"><input type="text"
class="nord-input border rounded-1 w-full align-bottom leading-normal outline-none appearance-none nord-input--small text-small px-3 py-2 text-grey-darkest border-grey-light" id="email" name="email" value=""
placeholder="Email address"></span></div>
<div class="mb-4"><span class="nord-input__wrapper relative inline-block w-full"><input type="text"
class="nord-input border rounded-1 w-full align-bottom leading-normal outline-none appearance-none nord-input--small text-small px-3 py-2 text-grey-darkest border-grey-light" id="company" name="company" value="" placeholder="Company"></span>
</div>
<div class="mb-4"><textarea class="nord-textarea p-3 border rounded-1 w-full h-auto outline-none appearance-none flex text-grey-darkest border-grey-light text-small" id="comment" name="comment" placeholder="Your message" rows="3"></textarea></div>
<button type="submit"
class="nord-button focus:outline-none font-medium leading-normal align-bottom rounded-1 select-none transition-colors ease-out duration-250 cursor-pointer border text-white nord-button--v-contained nord-button--c-purple bg-purple border-purple w-full">Send
Message</button>
<div class="mt-6">
<p class="nord-text text-micro leading-normal">We will only use this information to reply to you as per our
<a class="nord-link cursor-pointer outline-none transition-colors duration-250 ease-out text-purple hover:text-purple-dark underline" href="https://business.nordsec.com/legal/privacy-policy" offset="113">Privacy Policy</a>.</p>
</div>
<div>
<div>
<div class="grecaptcha-badge" data-style="bottomleft"
style="width: 256px; height: 60px; display: block; transition: left 0.3s ease 0s; position: fixed; bottom: 14px; left: -186px; box-shadow: gray 0px 0px 5px; border-radius: 2px; overflow: hidden;">
<div class="grecaptcha-logo"><iframe title="reCAPTCHA"
src="https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdSLVMfAAAAAMdnYC1cNgRqInCN7Wl8UmqHTsPd&co=aHR0cHM6Ly9ub3JkbG9ja2VyLmNvbTo0NDM.&hl=de&type=image&v=Km9gKuG06He-isPsP6saG8cn&theme=light&size=invisible&badge=bottomleft&cb=1t0pdra7oty6"
width="256" height="60" role="presentation" name="a-i67reenig9ri" frameborder="0" scrolling="no" sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox"></iframe>
</div>
<div class="grecaptcha-error"></div><textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response"
style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"></textarea>
</div><iframe style="display: none;"></iframe>
</div>
</div>
</form>Text Content
Holiday Deal
get the deal
Features
Plans
Apps
Desktop
macOS
Windows
Mobile
Android
iOS (Coming soon)
Blog
Business
Go Premium
Help
Log in
NordLockerEncryption with cloud storageNordVPNOnline security and
privacyNordPassPassword management
Features
Plans
Apps
Desktop
macOS
Windows
Mobile
Android
iOS (Coming soon)
Blog
Business
Help
Log in
Products
NordLocker
NordVPN
NordPass
Go Premium
RANSOMWARE STATISTICS:
WHO IS TARGETED
THE MOST?
Ransomware is a virus that takes over a device and demands a ransom from the
victim to get their files back. It is by far the biggest threat businesses face,
as it’s capable of crippling a business of any size and permanently staining its
reputation. To answer which companies are targeted the most, we’ve analyzed a
collection of ransomware cases that occurred between January 2020 and July 2022.
This is what we found.
Get the report
5,212Recorded cases
$4.15 trillionCollective revenue of targeted companies
12 million+Number of employees affected
RANSOMWARE DISTRIBUTION WORLDWIDE
While ransomware is a global problem, English-speaking and other Western
countries are targeted the most. In this map, we’re using NordLocker’s
Ransomware Risk Index to better understand the threat of being targeted by
ransomware around the world. What is RRI?
TOP 10 COUNTRIES MOST AFFECTED BY
RANSOMWARE
1
USA
2
Canada
3
UK
4
France
5
Germany
6
Italy
7
Brazil
8
Spain
9
Australia
10
India
Show all countries by RRI
Source: Ransomware groups' websites
United States
RRI
1
Canada
RRI
1
United Kingdom
RRI
0.9
France
RRI
0.9
Germany
RRI
0.8
Italy
RRI
0.9
Brazil
RRI
0.6
Spain
RRI
0.8
Australia
RRI
0.9
India
RRI
0.3
Switzerland
RRI
1
Japan
RRI
0.6
Mexico
RRI
0.6
Austria
RRI
0.9
Netherlands
RRI
0.8
Belgium
RRI
0.9
China
RRI
0.2
Hong Kong
RRI
0.9
South Africa
RRI
0.6
United Arab Emirates
RRI
0.8
Argentina
RRI
0.6
Taiwan
RRI
0.7
Indonesia
RRI
0.4
Norway
RRI
0.9
Singapore
RRI
0.9
Israel
RRI
0.8
Portugal
RRI
0.8
Sweden
RRI
0.8
Thailand
RRI
0.5
Colombia
RRI
0.6
Saudi Arabia
RRI
0.6
Chile
RRI
0.7
Denmark
RRI
0.9
Turkey
RRI
0.5
Peru
RRI
0.6
Greece
RRI
0.7
Poland
RRI
0.6
New Zealand
RRI
0.9
Czechia
RRI
0.7
Costa Rica
RRI
0.8
Philippines
RRI
0.4
Romania
RRI
0.6
Malaysia
RRI
0.6
South Korea
RRI
0.5
Ecuador
RRI
0.6
Hungary
RRI
0.7
Ireland
RRI
0.8
Lebanon
RRI
0.7
Dominican Republic
RRI
0.6
Venezuela
RRI
0.5
Kuwait
RRI
0.7
Qatar
RRI
0.8
Luxembourg
RRI
1
Pakistan
RRI
0.2
Honduras
RRI
0.6
Vietnam
RRI
0.3
Nigeria
RRI
0.2
El Salvador
RRI
0.6
Egypt
RRI
0.2
Jamaica
RRI
0.7
Oman
RRI
0.6
Slovenia
RRI
0.8
Iran
RRI
0.8
Finland
RRI
0.6
Bosnia & Herzegovina
RRI
0.7
Lithuania
RRI
0.7
Croatia
RRI
0.7
Cyprus
RRI
0.8
Sri Lanka
RRI
0.4
Morocco
RRI
0.3
Serbia
RRI
0.5
Nicaragua
RRI
0.5
Botswana
RRI
0.7
Bulgaria
RRI
0.5
Mongolia
RRI
0.6
Kenya
RRI
0.3
Russia
RRI
0.1
Angola
RRI
0.3
Brunei
RRI
0.8
Tunisia
RRI
0.4
Bangladesh
RRI
0
Bahamas
RRI
0.8
Senegal
RRI
0.3
Côte d’Ivoire
RRI
0.3
Congo - Brazzaville
RRI
0.5
Ethiopia
RRI
0.1
Trinidad & Tobago
RRI
0.7
Fiji
RRI
0.7
Puerto Rico
RRI
0.6
Slovakia
RRI
0.5
Myanmar (Burma)
RRI
0.2
Burkina Faso
RRI
0.3
Albania
RRI
0.6
Ghana
RRI
0.2
Algeria
RRI
0.2
Paraguay
RRI
0.4
Iraq
RRI
0.2
Estonia
RRI
0.7
Uruguay
RRI
0.5
Malta
RRI
0.8
Jordan
RRI
0.4
Kazakhstan
RRI
0.3
North Macedonia
RRI
0.6
Panama
RRI
0.5
Liberia
RRI
0.5
Mauritius
RRI
0.7
Zimbabwe
RRI
0.3
Ransomware risk index (RRI)
HighAverageLowNo data available
*Explore an interactive map with more
information on a desktop device.
RANSOMWARE CASES
ACROSS
THE US
By sheer numbers, California, Texas, Florida, and New York top ransomware
reports. However, after adjusting the attack rate iby the number of businesses
active in the state, Michigan takes the lead. Meanwhile, Missouri and South
Dakota are more than 10 times safer for businesses.
Source: Ransomware groups’ websites and US Bureau of Labor Statistics
RANSOMWARE CASES BY INDUSTRY
Companies affected by ransomware come from a variety of industries. However, the
ones that are targeted the most often play a critical role in supply chains or
handle lots of customer data. These factors put immense pressure on the
companies to pay the ransom and resume operations. The research shows that other
factors include an insufficient focus on cybersecurity, high-stakes working
conditions, and a lack of resources. These industries are likely chosen because
of the high attack success rate.
Rank
Industry
Number of cases
* 1
Manufacturing
436
* 2
Construction
410
* 3
Transportation/Logistics
356
* 4
Tech/IT
343
* 5
Healthcare
259
* 6
Finance/Insurance
251
* 7
Public sector
238
* 8
Business Services
236
* 9
Retail
232
* 10
Consumer Services
228
* 11
Energy
194
* 12
Legal services
176
* 13
Food production
175
* 14
Education
161
* 15
Materials
155
* 16
Automotive
139
* 17
Real Estate
126
* 18
Entertainment
102
* 19
Other
63
Source: Ransomware gangs’ websites and publically available financial databases
WHO IS RESPONSIBLE FOR THE ATTACKS?
Ransomware groups are not common thieves. Instead of hiding, they proudly
display their achievements because that may help bully the victim into paying
the ransom. Some of these groups are even protected by their governments in
agreement that attacks won’t be carried out in their country. While two groups
(Lock Bit and Conti) top the list as the most active ransomware groups by far,
the analysis did not measure the magnitude or impact of each group individually.
Rank
Group
Cases reported
* 1
Lock Bit
855
* 2
Conti
796
* 3
Pysa
311
* 4
REvil
284
* 5
Maze
264
* 6
Egregor
204
* 7
DoppelPaymer
199
* 8
Avaddon
182
* 9
NetWalker
144
* 10
AlphaVM (Blackcat)
123
* 11
Hive Leaks
122
* 12
Cl0p Leaks
115
* 13
Darkside
99
* 14
Grief
85
* 15
Everest
85
* 16
Vice Society
77
* 17
LV Blog
76
* 18
Marketo
71
* 19
Karakurt
68
* 20
AvosLocker
62
Source: ransomware gang websites
HOW DOES COMPANY SIZE IMPACT THE RANSOMWARE THREAT?
Are smaller companies targeted less because of their limited resources? Or maybe
more? As our analysis shows, it’s neither. While the fewest ransomware attacks
were recorded against companies worth between $5 and $10 billion, companies
earning over $10 billion had twice as many cases. Moreover, companies with less
than $1 million in revenue and thoses between $500 million and up to $1 billion
were targeted at a similar rate.
The research has also found that small and medium-sized companies between 11 and
50 employees as well as companies with 51-200 employees suffered the most
attacks. One-person businesses suffered the least.
Cases per annual revenueCases per employee count
Source: Ransomware groups’ websites and
publicly available financial databases
Protect your business from ransomware
Get NordLocker Business
WHAT IS RANSOMWARE?
By definition, ransomware is a type of malware that restricts user’s access to
their files and demands a payment. But how it does it, what kind of a payment is
requested, and what is encrypted differs a lot.
Ransomware has been employed for decades, but never at the level it is used
today. Last year, some businesses faced ransom demands of $30 million.
Ransomware is effective because most companies are ill-equipped to deal with it.
To increase the likelihood of the ransom being paid, criminals may also threaten
to post their victim’s data online.
* TYPES OF RANSOMWARE
* HOW RANSOMWARE WORKS
* WHO IS AT RISK?
* RANSOMWARE EXAMPLES
There are several ways to classify ransomware. The most popular one
differentiates between malware that encrypts your data (crypto ransomware) and
malware that only locks your screen (ransom lockers).
* Crypto ransomware
As the research suggests, this is the most prominent type of ransomware
today. It uses modern cryptographic algorithms to encrypt the victim’s data
and offers a decryptor — at a price.
* Ransom lockers
Instead of using encryption to prevent the victim’s access to their files,
ransom lockers block the entire device. The ransom note will instruct the
user to make a payment within 48 hours and sometimes even prohibit turning
off their device. In this case, the victim cannot use the machine until they
pay a ransom or until the timer runs out and the data is publicized or wiped
completely.
Ransomware attacks use technology to infiltrate, steal, and encrypt data as well
as use psychological tricks to scare, humiliate, or fool the victim into paying
the ransom. Here’s how a typical case might go:
1. The malware infiltrates the device. This can be done by executing an attack
against a specific person or launching a broad phishing campaign. Usually,
one wrong click by the victim is enough to perform the attack.
2. The malware encrypts the device. It can sit on the device for days sending
the data to cybercriminals or attack immediately.
3. The malware displays the ransom note. Different tactics can be at play here.
The attackers may pose as law enforcement agents claiming they blocked the
device because of some illegal content. They may also openly admit they’re
after a ransom. The note always includes instructions on how to purchase and
transfer cryptocurrency. It may also have a timer that increases the ransom
amount at intervals putting more pressure on the victim to pay up.
4. If the timer runs out, the malware will wipe your drive, publish the data,
or both. However, even in cases where ransomware is paid, there is no
guarantee the device will be unlocked.
Based on this research and the cases made public throughout the decades, anyone
can be targeted. Cases involving big-name companies and huge ransom demands may
get more publicity, but ransomware affects both individuals and companies of all
sizes. Government institutions and infrastructure also frequently end up in the
crosshairs of cybercriminals.
Recently, the attacks got bolder and more frequent. You may have heard of these
cases or have even been affected by them. For example, the 2021 Colonial
Pipeline ransomware case impacted millions of consumers and businesses.
Eventually, the privately-held company was forced to pay $5 million to get its
systems back.
A few months after the Colonial Pipeline ransomware attack, there was another,
even a bigger one. Cybercriminals targeted Kaseya, a major software supplier,
gaining access to the data of thousands of other companies around the world.
While the ransom demand was $70 million, the company claims they did not pay and
instead acquired a universal decryptor from a third party.
HOW YOU CAN HELP PROTECT YOUR BUSINESS FROM RANSOMWARE
1
ENCOURAGE CYBERSECURITY TRAINING
Cybersecurity training is one of the fastest ways to prevent ransomware. It has
to be organized regularly and involve everyone in the company because each
person is a part of your company’s cybersecurity.
2
PAY EXTRA ATTENTION TO EMAIL
By far, the most popular way to spread malware is by email. Be extra careful
when an email contains links or files. Learn how to recognize a fake email
domain or a spoofed website.
3
INTRODUCE BETTER SECURITY TOOLS
Tools like NordLocker are built to help companies maintain their reputation.
It's a secure cloud where you can work daily while your data is backed up,
synced, and secure on your device and in the cloud.
4
NURTURE A CULTURE OF SUPPORT
Reporting threats or asking for help should be straightforward. Moreover, it
should be encouraged and celebrated. This helps keep everyone sharp, catch
threats early, and recognize training opportunities.
5
ASSESS YOUR CURRENT SECURITY
A company is prepared to face cyberattacks only when it has evaluated its
cybersecurity capabilities. Such assessment helps counter the company's flaws
either in-house or by involving third parties.
6
CREATE A DISASTER RECOVERY PLAN
To force the victim to pay the ransom, criminals use a variety of tactics like
urgency, humiliation, and intimidation. If you prepare a response plan in
advance and introduce it to everyone in the company, it will help prevent and
respond to a ransomware attack.
7
ENSURE A REGULAR BACKUP PROCESS
Backups can't stop cyberattacks, but they give the company leverage. Even if a
company becomes a target for ransomware, the ability to restore data right away
will guarantee business continuity.
8
KEEP SOFTWARE UP TO DATE
Most cyberattacks either use social engineering to prey on the flaws in human
nature or malware to exploit outdated software. Make sure everyone at the
company understands how important it is to keep software updated.
9
IF YOU CAN, NEVER PAY THE ATTACKERS
Ransomware attacks have blown up because they're profitable. Paying the ransom
only funds the criminals to launch more attacks. While each case is unique, we
encourage everyone to explore all options before paying off the criminals.
METHODOLOGY
Data collection: The data was collected from multiple publicly available online
blogs where ransomware groups had posted the names of their victims and their
demands. The exact names of URLs and other identifying information of those
blogs remain undisclosed in this report for a reason. It follows from the fact
that we do not want to encourage visits to sources that publicize information
related to illegal activities. To the best of our knowledge, the ransomware
attacks analyzed in this report happened between 01/01/2020 and 01/07/2022.
Financial, employee count, and industry data was collected from numerous
publicly available databases. All the previously said data was collected from
25/05/22 to 01/07/2022.
Analysis: For the world map, we compared the number of ransomware cases with UN
population statistics to get the per capita number. We then logarithmically
normalized these numbers to produce scaled ratings between 0 and 1. The map of
US states was devised by comparing the number of ransomware cases in each state
with company census data from the U.S. Bureau of Labor Statistics.The remaining
data blocks were devised by matching targeted companies with publicly available
financial, employee count, or industry data.
GET IN TOUCH
If you’d like to learn more about protecting your business from ransomware,
please fill out the form. To know more about the report, contact us at
press@nordlocker.com.
Download research data
Send Message
We will only use this information to reply to you as per our Privacy Policy.
This website uses cookies. To learn more, visit our Privacy Policy.
Accept
Product
Features
Business
Why NordLocker
Secure Cloud Storage
Apps
Windows
Mac
Android
iOS (Coming soon)
Pricing
Plans
Earn money
Affiliate
Influencers
resources
Blog
Malware research
Ransomware research
Company
About Us
Careers
Contact Us
Press Area
Help Center
DISCOVER
Nord Security
NordVPN
NordPass
NordLayer
Privacy PolicyPrivacy Policy (Business)Terms of ServiceTerms of Service
(Business)DPA (Business)
Copyright © 2022
NordLocker.com
support@nordlocker.com
Follow Us