By Martin Ekpeke
A new report by Sophos, a cybersecurity leader, reveals a troubling trend for critical infrastructure, particularly in the energy and water sectors. These sectors saw a dramatic increase in median recovery costs from ransomware attacks, jumping to a staggering $3 million in 2024 – a fourfold rise compared to the previous year. This is significantly higher than the global average across all industries.
The report, titled “The State of Ransomware in Critical Infrastructure 2024,” highlights the vulnerability of these essential services. Nearly half (49%) of ransomware attacks against energy and water providers exploited weaknesses in their systems.
The data for the report comes from a survey of nearly 300 organizations within the energy, oil and gas, and utilities sectors. This aligns with the Energy and Water categories defined by CISA (Cybersecurity and Infrastructure Security Agency) as critical infrastructure.
The findings are part of a larger Sophos survey conducted earlier this year that included over 5,000 cybersecurity professionals across 14 countries and 15 industries.
According to Chester Wisniewski, a Sophos security expert, attackers target utilities because disruptions cause significant public pressure for swift resolutions. This can lead to faster ransom payments in hopes of restoring services quickly.
Wisniewski emphasizes the unique challenges faced by utilities. Their focus on high availability and safety, coupled with an engineering mindset geared towards physical security, can leave them vulnerable to cyberattacks. Many utilize older technologies configured for remote access without modern security measures like encryption and multi-factor authentication. Similar to hospitals and schools, these organizations often operate with limited staffing, making it difficult to stay on top of security updates and maintain the necessary vigilance for early detection and response.
The situation is further compounded by a significant increase in ransom demands. The median ransom payment for organizations in the energy and water sectors reached over $2.5 million in 2024, exceeding the global average by half a million dollars.
These sectors are also the second-most targeted by ransomware attacks. A staggering 67% of energy and water providers reported being hit in 2024, compared to the global average of 59%.
The report highlights additional concerning trends:
- Lengthened Recovery Times: Only 20% of ransomware victims in the energy and water sectors recovered within a week in 2024, a significant drop from previous years. This compares to 35% across all sectors taking more than a month to recover.
- Compromised Backups and Encryption Success: These critical infrastructure sectors had the highest rate of compromised backups (79%) and the third highest rate of successful encryption (80%) by attackers.
The report also discourages paying ransoms. While over 60% of victims paid ransoms in 2024, it did not lead to faster recovery times. These high ransom payments incentivize further attacks and undermine their supposed benefit of quicker restoration.
Sophos urges utilities to take a proactive approach by monitoring remote access points and network devices for vulnerabilities. Implementing 24/7 monitoring and response capabilities is crucial to minimize outages and expedite recovery. Developing and regularly practicing incident response plans, similar to those used for natural disasters, is essential to effectively respond to cyberattacks.