Cyber-attacks are crippling organisations. Not only are they taking down entire networks and sparing no industries, including healthcare and the charity sector, but the rise of ransomware attacks is now adding a price vulnerable organisations are being cornered into paying.

The demanded cost is rising too, with the average ransomware payment being $220,000 in the first quarter of 2021, which is a huge increase from just $6,733 at the end of 2018.

Not only are cyber criminals ruthless and demanding higher payments, but attacks themselves have become more sophisticated than ever meaning that even the largest organisations can become prime targets.

Just look at the ransomware attack on the largest meat processing company, JBS, in May this year. The attack resulted in a temporary shutdown of operations in the US as well as JBS’ 47 sites in Australia. The company paid in excess of US$11 million to mitigate any further operational loss.

The irreparable cost of ransomware

The cost of ransomware does not stop once a payment has been made – even if an organisation regains access to their data and nothing has been stolen.

Like ransomware, downtime also entails hidden costs. How would the thousands of JBL employees who were temporarily stood aside feel about the company after the attack? Ransomware attacks have lasting effects on customer purchasing behaviour, stock prices and brand loyalty. With 38% of businesses saying their reputation was harmed because of ransomware, an already fickle customer loyalty landscape can mean that just one attack results in significant stakeholder loss.

In fact, a study showed 61% of consumers changed some or all of their business from one brand to another in the past year, with 77% admitting their loyalty shifts quicker than it did three years prior.

Regardless of their valuation, businesses spend a significant portion (roughly 7-8% on average) of their revenue on sales and marketing to raise awareness of their brands and be top-of-mind for their audience. An attack, or the resultant downtime, that extends to a customer or partner could undermine any equity a business has accumulated through ad spend, social media buys and other advertising and marketing channels.

Go beyond data back-up as a defensive measure

The easiest way to recover data from a ransomware attack is by ensuring it is backed up. Unfortunately, many businesses fall into the trap of relying on back-up–or insufficient back-up–as their only defense against these attacks. But no one single measure is adequate. Without a layered approach of both preventative security and comprehensive data protection practices, called cyber resilience, criminals will find their way into an organisation, often via an organisation’s biggest threat: its people.

Cyber criminals only need to trick one person into clicking a malicious link in an email, opening a fake attachment, or visiting an infected website thinking it is legitimate.

Because of this, security awareness training is the single most effective way to address the common threat vectors that lead to successful ransomware attacks. Training employees with phishing simulations is more effective when conducted more frequently, and Webroot found that after 12 sessions, click rates on malicious links and attachments can drop up to 50%.

In addition, businesses can conduct external audits on their security posture to uncover vulnerabilities in software, deploy two-factor/multi-factor authentication, and implement internet threat intelligence and DNS filtering to block malicious sites.

Ultimately, having a strong cyber resilience strategy in place to protect against ransomware infections in the first place is crucial to mitigating costs, both in the form of ransomware payments and reputational damage, so organisations need to ensure they have full protection in place or risk paying the price.