7 in 10 government groups encrypt their data after ransomware attack

Nearly three in every four (72%) state and local government organisations that were attacked by ransomware had their data encrypted,  7% more than the cross-sector average, according to The State of Ransomware in State and Local Government 2022 report from Sophos.

Findings are based on a survey covering 5,600 IT professionals in mid-sized organisations across 31 countries, including 199 respondents from the state and local government sector.

Results show that only 20% of state and local government organisations were able to stop the ransomware attack before data could be encrypted —significantly less than the cross-sector average of 31% (8% had their data held for ransom but not encrypted). 

However, at the same time, the government sector had one of the lowest attack rates with only 58% hit by ransomware in 2021.

“Traditionally, government organisations haven’t been prime targets for ransomware attackers, since they don’t have as much money as traditional businesses, and criminal groups are reticent to attract attention from law enforcement,” said Chester Wisniewski, principal research scientist at Sophos.

“However, when these organisations do get hit, they have little in the way of protection because they don’t have the budget for additional, in-depth cybersecurity support, including threat hunting teams or security operations centers,” said Wisniewski.

Wisniewski said one reasons for this is that, while organisations collect a large amount of sensitive information, they need to keep this information easily accessible. Second, they need to spend the majority of their budget on their actual municipality. 

“Taxpayers can see if the streets are clean or if their schools are reaching their education goals,” he said. “They can’t ‘see’ a cyberattack or understand why a Managed Detection and Response (MDR) provider might be necessary to defeat ransomware,”

In addition to experiencing a high encryption rate, the government sector also experienced a significant drop in the amount of encrypted data recovered after paying the ransom when compared to 2020 — 58% in 2021 versus 70% in 2020. This was also lower than the cross-sector average of 61%.

Findings also show that in 2021, there was a 70% rise in the number of ransomware attacks against local government organisations, and 58% were targeted when compared to 34% in 2020.

The cost for government organisations to remediate an attack was three times the average ransom the sector paid.

Sophos experts recommend that organisations install and maintain high-quality defenses across all points in the environment. 

Also, they should proactively hunt for threats to identify and stop adversaries before they can execute attacks. If the team lacks the time or skills to do this in-house, outsource to a Managed Detection and Response (MDR) team.

Also, they should harden the IT environment by searching for and closing key security gaps — unpatched devices, unprotected machines and open RDP ports, for example. Extended Detection and Response (XDR) solutions are ideal for this purpose.