The newest annual Sophos examine of the real-world ransomware experiences of state and native authorities organizations explores the complete sufferer journey, from assault fee and root trigger to operational influence and enterprise outcomes.
This 12 months’s report sheds mild on new areas of examine for the sector, together with an exploration of ransom calls for vs. ransom funds and the way usually state and native authorities organizations obtain help from legislation enforcement our bodies to remediate the assault.
Obtain the report to get the complete findings.
Assault charges have gone down, however restoration is dearer
State and native authorities organizations reported the bottom fee of assaults of all sectors surveyed in 2024. 34% of state and native authorities organizations have been hit by ransomware in 2024, a 51% discount within the assault fee reported in 2023 (69%).
Virtually all (99%) state and native authorities organizations hit by ransomware up to now 12 months mentioned that cybercriminals tried to compromise their backups through the assault. Of the makes an attempt, simply over half (51%) have been profitable – one of many lowest charges of backup compromise throughout sectors.
98% of ransomware assaults on state and native authorities organizations resulted in information encryption, a substantial enhance from the 76% encryption fee reported in 2023. That is the best fee of information encryption of all sectors studied in 2024.
The imply price in state and native authorities organizations to get well from a ransomware assault was $2.83M in 2024, greater than double the $1.21M reported in 2023.
Gadgets impacted in a ransomware assault
On common, 56% of computer systems in state and native authorities organizations have been impacted by a ransomware assault, above the cross-sector common of 49%. Having the complete atmosphere encrypted is extraordinarily uncommon, with solely 8% of organizations reporting that 81% or extra of their units have been impacted.
The propensity to pay the ransom has elevated
78% of state and native authorities organizations restored encrypted information utilizing backups, the second highest fee of backup use reported (tied with increased schooling). 54% paid the ransom to get information again. Compared, globally, 68% used backups and 56% paid the ransom.
The three-year view of state and native authorities organizations reveals a gentle rise in each the usage of backups and the sector’s propensity to pay the ransom.
A notable change over the past 12 months is the rise within the propensity for victims to make use of a number of approaches to get well encrypted information (e.g., paying the ransom and utilizing backups). On this 12 months’s examine, 44% of state and native authorities organizations that had information encrypted reported utilizing a couple of technique, 4 occasions the speed reported in 2023 (11%).
Victims not often pay the preliminary ransom sum demanded
49 state and native authorities respondents whose organizations paid the ransom shared the precise sum paid, revealing that the common (median) cost was $2.2M in 2024.
Solely 20% paid the preliminary ransom demand. 35% paid lower than the unique demand, whereas 45% paid extra. On common, throughout all state and native authorities respondents, organizations paid 104% of the preliminary ransom demanded by adversaries.
Obtain the complete report for extra insights into ransom funds and lots of different areas.
Concerning the survey
The report is predicated on the findings of an impartial, vendor-agnostic survey commissioned by Sophos of 5,000 IT/cybersecurity leaders throughout 14 international locations within the Americas, EMEA, and Asia Pacific, together with 270 from the state and native authorities sector. All respondents signify organizations with between 100 and 5,000 staff. The survey was performed by analysis specialist Vanson Bourne between January and February 2024, and members have been requested to reply primarily based on their experiences over the earlier 12 months.