The Beazley Data Breach Insights Report is an annual publication summarizing the data breaches experienced by the company’s clients in the first nine months of the year. This year’s report shows there has been a 65% increase in data breaches in 2016, rising from 931 data breaches in 2015 to 1,437 breaches in 2016.
Ransomware attacks have also increased significantly. There were 43 known attacks in 2015, whereas in 2016 the total has already reached 150. If ransomware attacks continue at the current rate, the end-of-year total is likely to have reached 200.
The 2016 Beazley Data Breach Insights Report shows hackers are concentrating on attacking financial institutions this year. Last year, 26% of data breaches affected financial institutions. This year the figure has risen to 39%. Healthcare data breaches are mostly caused by careless or negligent employees. Last year, 28% of healthcare data breaches were the result of mistakes by employees. This year, 40% of data breaches have been caused by carelessness or negligence. Malware and hacking attacks on healthcare organizations are down from 28% in 2015 to 19% in 2016.
The biggest threat to the retail sector comes from hackers and malware, with little change in attacks year on year. In 2016, 53% of attacks were due to hackers and malware up 2% from 2015. Hacking and malware has increased for the education sector, with attacks up from 38% in 2015 to 46% in 2016. Taking all industries as a whole, hacking and malware attacks have remained fairly constant. In 2015, 32% of attacks were the result of hacking or malware. This year the total stands at 31%.
Data thieves are still able to sell stolen credentials, health data, and credit card numbers on the darknet; however, the rise in ransomware attacks show criminals are finding it much easier – and more profitable – to hold companies to ransom by encrypting their data. The price of stolen credentials has fallen as the market has been flooded with stolen data. Ransomware allows criminals to make up for their losses.
Consequently, ransomware attacks have skyrocketed. The Beazley Data Breach Insights Report shows that in just two months over the summer there were more recorded ransomware attacks than in the whole of 2015. In 2015, there were 43 recorded ransomware attacks. Between July and August 2016 alone there were 52.
Ransomware causes considerable disruption and major costs for the attacked organization, although the typical ransom payments made are usually quite low. According to the 2016 Beazley Data Breach Insights Report, the average payment made by organizations to recover data was only $1,000. However, add in the loss of productivity as a result of the attack, the time spent by the IT department resolving the infection, the costs of external security experts to conduct forensic analyses and security reviews, and the additional security measures that need to be employed to prevent future attacks and the cost of an attack is considerable.
Given the extent to which attacks are taking place, it is essential that organizations develop ransomware response plans. This will limit the financial damage caused if an attack is experienced. Managers and employees should receive regular security awareness training and a host of prevention tools should be employed to defend against attacks. Organizations should also conduct regular risk assessments to ensure vulnerabilities are rapidly identified and addressed to reduce risk.