65% of Singaporean organizations hit by ransomware in 2021

Ransomware continues to affect organizations all over the world. In Southeast Asia, Singapore is one of the most advanced countries in the world when it comes to tech adoption. However, with increased usage and dependence on technology, the risks that come with it increase as well.

According to a report by Sophos, 65% of Singaporean organizations surveyed in its State of Ransomware 2022 report were hit with ransomware in 2021. With a 25% increase since 2020, the average ransom paid by organizations in Singapore that had data encrypted in their most significant ransomware attack also increased by more than sixfold from US$187,500 in 2020 to US$1.16 million in 2021.

Despite having sufficient data recovery and backup capabilities, 48% of the organizations that had data encrypted still paid the ransom to get their data back. The report summarises the impact of ransomware on 5,600 mid-sized organizations in 31 countries across Europe, the Americas, Asia-Pacific, Central Asia, the Middle East, and Africa, with 965 sharing details of ransomware payments.

For Chester Wisniewski, a principal research scientist at Sophos, the survey showed that the proportion of victims paying up continues to increase, even when they may have other options available. He believes there could be several reasons for this, including incomplete backups or the desire to prevent stolen data from appearing on a public leak site.

“In the aftermath of a ransomware attack, there is often intense pressure to get back up and running as soon as possible. Restoring encrypted data using backups can be a difficult and time-consuming process, so it can be tempting to think that paying a ransom for a decryption key is a faster option. It’s also an option fraught with risk,” commented Wisniewski.

He also pointed out that organizations don’t know what the attackers might have done, such as adding backdoors, copying passwords, and more. If organizations don’t thoroughly clean up the recovered data, they’ll end up with all that potentially toxic material in their network and potentially exposed to a repeat attack.

The report also showed that 64% of attacks resulted in data being encrypted, a considerable increase from the 49% that was reported by respondents in Singapore in 2020.  The average cost to recover from the most recent ransomware attack in 2021 for organizations in Singapore was US$1.9 million.

While the amount has decreased from 2020, it took about a month to recover from the damage and disruption. As such, 87% of organizations said the attack had impacted their ability to operate, and 83% of victims said they had lost business and/or revenue because of the attack.

Interestingly, the report also highlighted that many organizations rely on cyber insurance to help them recover from a ransomware attack. 86% of mid-sized organizations had cyber insurance that covers them in the event of a ransomware attack, and, in almost all incidents, the insurer paid some or all the costs incurred.

To avoid future ransomware attacks, all Singaporean respondents said their organizations have made changes to their cyber defenses over the last year to improve their insurance position. 80% have implemented new technologies and services. 60% have also increased staff training and education activities, and 53% have changed their processes and behaviors.

Wisniewski added, “in recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service. Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands.”

However, Wisniewski believes the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky-high ransoms.

“Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit,” he said.

---

---

---

---