This Encryption Rate Was the Third Highest Across All Sectors Surveyed and Was 7% More Than the Cross-Sector Average
Dubai: Sophos, a global leader in next-generation cybersecurity, today published a new sectoral survey report, The State of Ransomware in State and Local Government 2022, which found that 72% of state and local government organizations attacked by ransomware had their data encrypted—7% more than the cross-sector average. In fact, only 20% of state and local government organizations were able to stop the ransomware attack before data could be encrypted —significantly less than the cross-sector average of 31% (8% had their data held for ransom but not encrypted). However, at the same time, the government sector had one of the lowest attack rates with only 58% hit by ransomware in 2021.
“Traditionally, government organizations haven’t been prime targets for ransomware attackers, since they don’t have as much money as traditional businesses, and criminal groups are reticent to attract attention from law enforcement. However, when these organizations do get hit, they have little in the way of protection because they don’t have the budget for additional, in-depth cybersecurity support, including threat hunting teams or security operations centers. And, there are a couple reasons for this. One is that, while they collect a large amount of sensitive information, they need to keep this information easily accessible. Second, they need to spend the majority of their budget on their actual municipality. Taxpayers can see if the streets are clean or if their schools are reaching their education goals. They can’t ‘see’ a cyberattack or understand why a Managed Detection and Response (MDR) provider might be necessary to defeat ransomware,” said Chester Wisniewski, principal research scientist, Sophos.
In addition to experiencing a high encryption rate, the government sector also experienced a significant drop in the amount of encrypted data recovered after paying the ransom when compared to 2020—58% in 2021 versus 70% in 2020; this was also lower than the cross-sector average of 61%.
Additional findings include:
“If we look at what happened with the city of Atlanta, Georgia, back in 2018, they ultimately ended up paying $17 million to recover from an attack that asked for $50,000 dollars in ransom. This is often the case with local and state government organizations—they spend far more on recovering and catching up with current security practices than they do on the actual ransom demand, should they choose to pay it. While getting the initial buy-in may be hard, in the long term, preemptive cybersecurity measures are a far better alternative than bolstering defenses after an attack,” said Wisniewski.
In the light of the survey findings, Sophos experts recommend the following best practices for all organizations across all sectors:
To learn more about the State of Ransomware in State and Local Government 2022, download the full report from Sophos.com.
The State of Ransomware in State and Local Government 2022 survey polled 5,600 IT professionals in mid-sized organizations across 31 countries, including 199 respondents from the state and local government sector.
Sophos is a worldwide leader in next-generation cybersecurity, protecting more than 500,000 organizations and millions of consumers in more than 150 countries from today’s most advanced cyberthreats. Powered by threat intelligence, AI and machine learning from SophosLabs and SophosAI, Sophos delivers a broad portfolio of advanced products and services to secure users, networks and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. Sophos provides a single integrated cloud-based management console, Sophos Central – the centerpiece of an adaptive cybersecurity ecosystem that features a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity vendors. Sophos sells its products and services through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.