Ransomware. The digital pandemic.
Every eleven seconds another organisation is hit. Ransomware has moved on from simple encryption into an extortion industry worth hundreds of billions.
44%
of breaches involve ransomware
- Average ransom
- £2.2M
- Projected cost by 2031
- £210B
- Backups targeted first
- Yes
44%
Ransomware present in breaches
£2.2M
Average ransom payment 2024
£210B
Projected cost by 2031
11 sec
Attack frequency
one attack, somewhere in the world
Ransomware has become an industry
Four stages of escalation, each one adding a new way to apply pressure once the data is already gone.
Stage 1
Encryption
Traditional ransomware encrypts files and demands payment for the decryption key. Simple but effective.
Example: WannaCry (2017) - Encrypted 200,000+ systems in 150 countries in one day
Stage 2 - Double Extortion
Data Exfiltration
Modern ransomware steals data before encrypting. Pay to decrypt AND pay to prevent public leak. Two ransoms.
Example: REvil pioneered this, now used by 77% of ransomware groups
Stage 3 - Triple Extortion
Business Disruption
Attack customers, partners, and suppliers. DDoS attacks on top of encryption and data theft. Maximum pressure.
Example: Vastaamo psychotherapy center - patients directly extorted after provider breach
The Industry
Ransomware-as-a-Service
Ransomware is now a business. Groups sell tools and share profits with affiliates. Low-skill attackers can launch sophisticated attacks.
Example: LockBit operates like a franchise, with affiliate programs and customer support
No organisation is immune
Hospitals, governments and household names. Ransomware does not discriminate.
Change Healthcare
2024100M+ patient records exposed
Ransom
£17.5 million paid
Downtime
Weeks of healthcare disruption
MGM Resorts
2023£79 million in losses
Ransom
Refused to pay
Downtime
10 days of casino operations down
Royal Mail
2023International shipping halted
Ransom
Refused £63M demand
Downtime
6+ weeks of disruption
City of Dallas
2023Police, court systems offline
Ransom
£6.7 million cost
Downtime
30+ days to restore services
Backups are not enough. Go offline.
Modern ransomware targets backups first. Connected backups can be encrypted or exfiltrated. Only a physically disconnected copy sits outside the reach of the attack.
Make ransomware irrelevant to your business
Discover how offline storage creates a copy that ransomware simply cannot reach.
Takes about 2 minutes. No account needed.