20% of Ransomware Attacks Involve Victim Harassment
Ransomware gangs are increasingly skipping file encryption and are concentrating on data theft and extortion, according to a recent report from Palo Alto Networks’ Unit 42 team. In the second half of 2021 and throughout 2022, around 1 in 10 attacks by ransomware gangs did not involve file encryption, only data theft and extortion.
Around one-third of incidents responded to by the Unit 42 team are ransomware incidents, 70% of which involve data theft, up from 40% of attacks in mid-2021. Data from Coveware indicates more victims of ransomware attacks are now refusing to pay ransom demands, and that has forced ransomware gangs to adopt more aggressive tactics. The Unit 42 team says, on average, ransomware gangs upload the data of 7 victims a day to their data leak sites, and it is becoming increasingly common for ransomware gangs to harass victims. 20% of the incidents Unit 42 responds to have some degree of victim harassment, compared to around 1% of attacks in mid-2021.
Michael Sikorski, CTO and VP of threat intelligence at Unit 42, said an attack on a hospital that refused to pay the ransom saw the threat actor contact patients and threaten to publish their medical records to pile pressure on the hospital to pay the ransom demand. In another case, the wife of the CEO of a company was sent threatening SMS messages when the ransom was not paid. When patients or customers of companies are contacted and harassed by a threat actor, the reputational damage caused can result in a considerable loss of business. Sikorski said victims of ransomware attacks are increasingly recovering files from backups and refusing to pay ransoms, but the harassment tactics could well see that trend reversed.
Organizations need to develop and practice an incident response plan to ensure the quickest possible recovery from a ransomware attack but Palo Alto Networks suggests it is also now vital to prepare a playbook for multi-extortion and to develop crisis communication protocols. “Having a comprehensive incident response plan with corresponding crisis communication protocols will greatly reduce uncertainty. It’s important to know which stakeholders should be involved, and the process to make decisions promptly (e.g., whether or not to pay, or who is authorized to approve payments).” It is important to know what to do – and not to do – when ransomware gangs start contacting and harassing employees or patients. Employees should be provided with ransomware harassment training and the tools and processes they need to follow during an active harassment incident. Having a playbook for multi-extortion will help to limit the harm that can be caused.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
