Retail became a top target for ransomware and data-theft
Retail organizations became a prime target for ransomware during the COVID-19 pandemic as many retailers started trading online.
Retail organizations were particularly vulnerable to a small but growing new trend: extortion-only attacks. In this scenario, the ransomware operators don’t encrypt files but threaten to leak stolen information online if a ransom demand isn’t paid, a survey by the cybersecurity company Sophos found.
The survey polled 5,400 IT decision-makers, including 435 retail IT managers, in 30 countries across Europe, the Americas, Asia-Pacific, Central Asia, the Middle East, and Africa.
Retail and education faced the highest level of ransomware attacks during 2020, with 44% of organizations hit (compared to 37% across all industry sectors).
“The retail sector has always been an attractive target for cyberattacks, with its complex, distributed IT environments, including a multitude of connected point-of-sale devices, a relatively transient and non-technical workforce, and access to a wide range of personal and financial customer data.” Chester Wisniewski, a principal research scientist at Sophos, is quoted in a press release. “The impact of the pandemic introduced additional security challenges that cybercriminals were quick to exploit.”
The total bill for rectifying a ransomware attack in the retail sector, considering downtime, people time, device cost, network cost, lost opportunity, ransom paid, and more, was $1.97M on average – compared to a cross-sector average of $1.85M.
“The comparatively high percentage of targets hit with data-theft-based extortion attacks is not entirely surprising. Service industries such as retail hold information that is often subject to strict data protection laws, and attackers are only too willing to exploit a victim’s fear of fallout from a data breach in terms of fines and damage to brand reputation, sales, and customer trust,” Wisniewski said.
According to the survey, over half (54%) of the retail organizations hit by ransomware said the attackers had successfully encrypted their data.
A third (32%) of those whose data was encrypted paid the ransom. The average ransom payment was $147,811 (lower than the global average of $170,404.) However, those who paid recovered on average only two-thirds (67%) of their data, leaving a third inaccessible, and just 9% got all their encrypted data back.
“It’s not all bad news for retail IT managers, however. While enabling, managing, and securing IT during the pandemic increased the overall IT workload for three-quarters of retailers – the sector was also the most likely (at 77%) to see a positive return in terms of enhanced cybersecurity skills and knowledge,” Wisniewski said.
To secure retail IT networks against ransomware and other cyberattacks, researchers advise IT teams to focus resources on three critical areas: building more robust defenses against cyberthreats, introducing security skills training for users, including part-time and temporary staff, where possible, and investing in more resilient infrastructure.