Nearly 75% of Local and State Government Organizations Attacked by Ransomware Had Their Data Encrypted, Sophos Survey Finds

Sophos Press Release

This Encryption Rate Was the Third Highest Across All Sectors Surveyed and Was 7% More Than the Cross-Sector Average

OXFORD, U.K. – Sept. 28, 2022 – Sophos, a global leader in next-generation cybersecurity, today published a new sectoral survey report, The State of Ransomware in State and Local Government 2022, which found that 72% of state and local government organizations attacked by ransomware had their data encrypted—7% more than the cross-sector average. In fact, only 20% of state and local government organizations were able to stop the ransomware attack before data could be encrypted —significantly less than the cross-sector average of 31% (8% had their data held for ransom but not encrypted). However, at the same time, the government sector had one of the lowest attack rates with only 58% hit by ransomware in 2021.

“Traditionally, government organizations haven’t been prime targets for ransomware attackers, since they don’t have as much money as traditional businesses, and criminal groups are reticent to attract attention from law enforcement. However, when these organizations do get hit, they have little in the way of protection because they don’t have the budget for additional, in-depth cybersecurity support, including threat hunting teams or security operations centers. And, there are a couple reasons for this. One is that, while they collect a large amount of sensitive information, they need to keep this information easily accessible. Second, they need to spend the majority of their budget on their actual municipality. Taxpayers can see if the streets are clean or if their schools are reaching their education goals. They can’t ‘see’ a cyberattack or understand why a Managed Detection and Response (MDR) provider might be necessary to defeat ransomware,” said Chester Wisniewski, principal research scientist, Sophos. 

In addition to experiencing a high encryption rate, the government sector also experienced a significant drop in the amount of encrypted data recovered after paying the ransom when compared to 2020—58% in 2021 versus 70% in 2020; this was also lower than the cross-sector average of 61%.

Additional findings include:

  • 2021 saw a 70% rise in the number of ransomware attacks against local government organizations; 58% were targeted when compared to 34% in 2020
  • The cost for government organizations to remediate an attack was three times the average ransom the sector paid

"If we look at what happened with the city of Atlanta, Georgia, back in 2018, they ultimately ended up paying $17 million to recover from an attack that asked for $50,000 dollars in ransom. This is often the case with local and state government organizations—they spend far more on recovering and catching up with current security practices than they do on the actual ransom demand, should they choose to pay it. While getting the initial buy-in may be hard, in the long term, preemptive cybersecurity measures are a far better alternative than bolstering defenses after an attack,” said Wisniewski.

In the light of the survey findings, Sophos experts recommend the following best practices for all organizations across all sectors:

  • Install and maintain high-quality defenses across all points in the environment. Review security controls regularly and make sure they continue to meet the organization’s needs
  • Proactively hunt for threats to identify and stop adversaries before they can execute attacks – if the team lacks the time or skills to do this in-house, outsource to a Managed Detection and Response (MDR) team
  • Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines and open RDP ports, for example. Extended Detection and Response (XDR) solutions are ideal for this purpose
  • Prepare for the worst, and have an updated plan in place of a worst-case incident scenario
  • Make backups, and practice restoring them to ensure minimize disruption and recovery time

 

To learn more about the State of Ransomware in State and Local Government 2022, download the full report from Sophos.com.

The State of Ransomware in State and Local Government 2022 survey polled 5,600 IT professionals in mid-sized organizations across 31 countries, including 199 respondents from the state and local government sector.

关于 Sophos

Sophos 是先进网络安全解决方案的全球领导者和创新者,包括托管式侦测与响应 (MDR) 和事件响应服务,各种端点、网络、电子邮件和云安全技术,帮助企业防御网络攻击。作为最大的纯网络安全供应商之一,Sophos 帮助全球超过 500,000 家企业和超过 1 亿用户抵御主动攻击对手、勒索软件、网络钓鱼、恶意软件等。Sophos 的服务和产品通过 Sophos Central 云管理控制台连接,并得到内部跨领域威胁情报部门 Sophos X-Ops 的支持。Sophos X-Ops 情报优化整个 Sophos Adaptive Cybersecurity Ecosystem 自适应网络安全生态体系,包括一个中央数据湖,为客户、合作伙伴、开发人员和其他网络安全与信息技术供应商提供一组丰富的开放 API。Sophos 为需要全托管并即使可用的安全解决方案的企业提供网络安全即服务,客户还可以直接利用 Sophos 的安全运行平台管理其网络安全,或者采用混合方法,为内部团队补充 Sophos 服务(包括威胁追踪与修复)。Sophos 通过世界各地的经销商合作伙伴和托管服务供应商 (MSP) 销售。Sophos 总部位于英国牛津。如欲了解更多信息,请访问 www.sophos.com