Sophos, a global leader in innovative security solutions, has released its fifth annual State of Ransomware in Retail report, revealing that more than half (58%) of retailers whose data was encrypted ultimately paid the ransom. This comes as the median ransom demand has doubled to $2 million and the average payment increased by 5% to $1 million.
The vendor-agnostic survey, conducted with IT and cybersecurity leaders across 16 countries, highlights four key findings that underscore the escalating threat landscape for the retail sector:
- Nearly half (46%) of attacks started with an unknown security gap, making it the top operational factor leading to a breach. This highlights persistent visibility challenges across the retail attack surface.
- 30% of attacks exploited known vulnerabilities, marking the third year in a row this has been the top technical root cause.
- 48% of attacks resulted in data encryption (a five-year low), yet 58% of those victims paid the ransom to recover their data.
- The median ransom demand doubled to $2 million, while the average payment rose 5% to $1 million. However, retailers are showing some resistance, as the average payment remains half the average demand.
Key Challenges and Encouraging Progress
The report indicates that limited in-house expertise (45%) and gaps in protection coverage (44%) are significant operational drivers of compromise, suggesting many retailers struggle with swift detection and neutralization. Adversaries, including active groups like Akira, Cl0p, and Qilin, frequently exploit vulnerabilities in remote access and internet-facing equipment.
Fortunately, the retail sector is showing signs of progress against ransomware. The percentage of attacks stopped before encryption reached a five-year high, and the data encryption rate is now at its lowest in five years (48%). Furthermore, the average cost of recovery (excluding any ransom payment) has declined significantly, dropping 40% over the past year to $1.65 million, marking its lowest point in three years. Encouragingly, retailers are also becoming more resistant to demands, with only 29% paying the initial ransom request and a strong majority (59%) successfully negotiating to pay less.
To combat the complex threat landscape, Sophos recommends a proactive, risk-management approach. This involves four key steps. First, Eliminate Root Causes by proactively addressing common weaknesses, such as exploited vulnerabilities, using solutions like Sophos Managed Risk to assess and reduce environmental exposure. Second, Defend Every Endpoint by ensuring comprehensive anti-ransomware defenses are installed on all endpoints, including servers. Third, Plan and Prepare by establishing and routinely testing a robust incident response plan, maintaining reliable backups, and practicing data restoration. Finally, Monitor Around the Clock by implementing continuous visibility and leveraging a trusted Managed Detection and Response (MDR) provider for 24/7 threat monitoring and expert response, especially if in-house resources are limited.