76% of Organizations Admit to Paying Ransomware Criminals, with One-Third Still Unable to Recover Data

Businesses are losing the battle when it comes to defending against ransomware attacks, according to the Veeam 2022 Ransomware Trends Report, which found that 72% of organizations had partial or complete attacks on their backup repositories, dramatically impacting the ability to recover data without paying the ransom. Veeam found that 80% of successful attacks targeted known vulnerabilities — reinforcing the importance of patching and upgrading software. Almost all attackers attempted to destroy backup repositories to disable the victim’s ability to recover without paying the ransom.

The report reveals the results of an independent research firm that surveyed 1,000 IT leaders whose organizations had been successfully attacked by ransomware at least once during the past 12 months, making it one of the largest reports of its kind. The first of its kind study examines the key learnings from these incidents, their impact on IT environments and the steps taken to implement Modern Data Protection strategies that ensure business continuity moving forward. The research project specifically surveyed four IT personas (CISOs, Security Professionals, Backup Administrators and IT Operations) to understand cyber-preparedness alignment across organizations.

Ransomware has democratized data theft and requires a collaborative doubling down from organizations across every industry to maximize their ability to remediate and recover without paying the ransom. Experts say paying cybercriminals to restore data is not a data protection strategy. There is no guarantee of recovering data, the risks of reputational damage and loss of customer confidence are high, and most importantly, this feeds a self-fulfilling prophecy that rewards criminal activity.

The survey further says that, the majority (76%) of cyber-victims paid the ransom to end an attack and recover data. Unfortunately, while 52% paid the ransom and were able to recover data, 24% paid the ransom but were still not able to recover data — resulting in a one out of three chance that paying the ransom still leads to no data. It is notable that 19% of organizations did not pay the ransom because they were able to recover their own data.

This is what the remaining 81% of cyber-victims must aspire to — recovering data without paying the ransom. The “attack surface” for criminals is diverse. Cyber-villains most often first gained access to production environments through errant users clicking malicious links, visiting unsecure websites or engaging with phishing emails — again exposing the avoidable nature of many incidents. After having successfully gained access to the environment, there was very little difference in the infection rates between data center servers, remote office platforms and cloud-hosted servers.

In most cases, the intruders took advantage of known vulnerabilities, including common operating systems and hypervisors, as well as NAS platforms and database servers, leaving no stone unturned and exploiting any unpatched or outdated software that they can find. It is notable that significantly higher infection rates were reported by Security Professionals and Backup Administrators, compared with IT Operations or CISOs, implying that “those closer to the problem see even more of the issues.”