A survey by cybersecurity company Sophos has found that retail organisations have become a popular target for ransomware and data stealing during the pandemic.
According to Cyber News, retail organisations were particularly vulnerable to extortion-only attacks. In this example, many ransomware operators don’t encrypt files but instead threaten to leak stolen information online if a ransom demand isn’t paid.
The survey harvested opinion from a total of 5,400 decision makers in the IT space, including 435 retail IT managers in 30 countries across Europe, the Americas, Central Asia, Asia Pacific, Africa and the Middle East.
Retail and education suffered the most ransomware attacks during 2020, with 44% of all companies hit by an attack.
The survey also found that the total cost for rectifying a ransomware attack in the retail sector – considering variables such as network and device cost, people time and ransom paid – was $1.97m on average, compared to a cross-sector average of $1.85m.
Over half – 54% – of all the retail companies hit by ransomware claimed that the attackers had successfully encrypted their data, while 32% of those who data was encrypted paid the ransom.
The average payment for a ransom was $147,811 – lower than a global average of $170,404 – however, those who paid the ransom only recovered on average 67% of their data, while only 9% got all their encrypted data back.
The survey also discovered that the retail sector was most likely at 77% to see a positive return in terms of enhanced cybersecurity skills and knowledge.
The survey concluded, “To secure retail IT networks against ransomware and other cyberattacks, researchers advise IT teams to focus resources on three critical areas: building more robust defences against cyberthreats, introducing security skills training for users, including part-time and temporary staff, where possible, and investing in more resilient infrastructure.”
Sophos principal research scientist Chester Wisniewski said, “The retail sector has always been an attractive target for cyberattacks, with its complex, distributed IT environments, including a multitude of connected point-of-sale devices, a relatively transient and non-technical workforce, and access to a wide range of personal and financial customer data The impact of the pandemic introduced additional security challenges that cybercriminals were quick to exploit.
“The comparatively high percentage of targets hit with data-theft-based extortion attacks is not entirely surprising. Service industries such as retail hold information that is often subject to strict data protection laws, and attackers are only too willing to exploit a victim’s fear of fallout from a data breach in terms of fines and damage to brand reputation, sales, and customer trust.”
Copyright © 2021 FinTech Global
