Retail segment faced the highest level of ransomware attacks in 2020, with 44 percent of organizations hit, according to Sophos report.
The “State of Ransomware in Retail” report is available here.
The bill for rectifying a ransomware attack in the retail sector, considering downtime, people time, device cost, network cost, lost opportunity, ransom paid, and more, was US$1.97 million on average – compared to a cross-sector average of US$1.85 million, the report on Cyber Security indicated.
Among the retail organisations hit by ransomware, 54 percent said the attackers had succeeded in encrypting their data. 32 percent of those whose data was encrypted paid the ransom. The average ransom payment was US$147,811 (lower than the global average of US$170,404.) However, those who paid recovered on average only two-thirds (67 percent) of their data, leaving a third inaccessible; and just 9 percent got all their encrypted data back.
Chester Wisniewski, principal research scientist at Sophos, said: “It’s not all bad news for retail IT managers, however. While enabling, managing, and securing IT during the pandemic increased the overall IT workload for three quarters of retailers – the sector was also the most likely (at 77 percent) to see a positive return in terms of enhanced cybersecurity skills and knowledge.”
Sophos recommends
# IT teams to focus resources on three critical areas
# Build stronger defenses against cyberthreats
# Introduce security skills training for users including part time and temporary staff
# Investment in more resilient infrastructure
The Sophos State of Ransomware in Retail, 2021, survey polled 5,400 IT decision makers, including 435 retail IT managers, in 30 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East, and Africa.
The growth in online retail increased existing security challenges facing the retail sector, including the use of legacy systems that are harder to maintain and update, and frequent mergers and acquisitions that require IT teams to integrate disparate systems.
Add to this the need to protect a wide range of valuable information, including customers’ personal and financial data, and the challenge of securing complex, distributed environments, and it is easy to see why retail is an attractive target for cybercriminals.
