Financial Services Firms Spend Over $2m on Ransomware Recovery

Security

Global financial services firms spent more than $2m on average recovering from a ransomware attack last year, according to new data from Sophos.

The UK security vendor polled 550 IT decision-makers in mid-sized financial sector firms around the globe to compile its State of Ransomware in Financial Services 2021 report.

It found that a third (34%) of firms in the vertical were hit by ransomware in 2020, with half (51%) admitting their attackers managed to encrypt data.

However, although most (62%) were able to restore scrambled data from backups, the recovery costs ascribed to victim organizations from the sector were much higher than the average across all verticals ($1.85m).

The figure is also surprising considering that only a quarter (25%) of financial services victims paid the ransom demand — the second-lowest payment rate of all industries surveyed and below the global average of 32%.

Sophos claimed the high cost of recovery is partly down to the highly regulated nature of the sector, with firms forced to adhere to multiple compliance mandates, including PCI DSS, SOX and GDPR.

“Strict guidelines in the financial services sector encourage strong defenses. Unfortunately, they also mean that a direct hit with ransomware is likely to be very costly for targeted organizations,” said John Shier, senior security advisor, Sophos.

“If you add up the price of regulatory fines, rebuilding IT systems and stabilizing brand reputation, especially if customer data is lost, you can see why the survey found that recovery costs for mid-sized financial services organizations hit by ransomware in 2020 were in excess of $2m.”

Interestingly, attackers hit only 8% of organizations in the sector with double extortion attacks, which now account for the majority of all ransomware, according to some estimates.

Although it fell slightly from the previous year, the financial services sector recorded the second-highest cost of a data breach in 2021, at $5.72m, according to IBM.

Products You May Like

Articles You May Like

Malicious PyPI Packages Use Compiled Python Code to Bypass Detection
API security in the spotlight – Week in security with Tony Anscombe
Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks
Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council’s Certified CISO Hall of Fame Report 2023
Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids’ Data on Xbox

Leave a Reply

Your email address will not be published. Required fields are marked *