2021RANSOMWARE
IMPACT REPORT2021 RANSOMWARE IMPACT REPORTContents
3Introduction and Methodology

4	The Consequences of Poor Cybersecurity Training
5	To Pay or Not to Pay
6

The High Indirect Costs of Ransomware

7

Percent of Attacks that Are Not Disclosed

15

About Keeper© 2021 Keeper Security, Inc.

2

2021 RANSOMWARE IMPACT REPORTIntroduction and Methodology
2021 is set to be the Year of Ransomware. As attacks rapidly spike in frequency, increasingly eye-popping
ransom demands are grabbing headlines. Consumers, once relatively shielded from any impact, areexperiencing product shortages and difficulty accessing services as the organizations they do business withare knocked offline.
But what happens within an organization post-attack? How are internal processes affected? What’s theimpact on employee efficiency and productivity? To find out, Keeper surveyed 2,000 employees across theU.S. whose employers had suffered a ransomware attack in the previous 12 months.
Keeper Security contracted with Pollfish to conduct this survey of 2,000 full time employees in the UnitedStates. Only individuals who work full time at companies victimized by ransomware attacks in the last twelve
months were included. The survey was completed in June 2021.

© 2021 Keeper Security, Inc.

3

2021 RANSOMWARE IMPACT REPORTThe Consequencesof Poor Cybersecurity
Training

Nearly one-third of employees lacked
adequate cybersecurity training prior tothe attack.
Employee cybersecurity awareness training is crucial
to preventing ransomware attacks, particularly since somany involved social engineering:•	Respondents reported that phishing emails caused
42% of ransomware attacks•Malicious websites accounted for another 23%•

Compromised passwords caused 21%

Yet 29% of respondents told Keeper they didn’t knowwhat ransomware was prior to their employers being
victimized. This indicates that many, if not mostransomware attacks could be prevented by:•	Adequately and routinely training employees oncybersecurity awareness, especially how to avoid
phishing and other social engineering schemes

A DAY LATE AND
A DOLLAR SHORT?
Respondents told us that postattack, 87% of organizations
enacted stricter security protocols,
90% provided their employeeswith additional cybersecurity
training, and 67% increased theircybersecurity spending.

•	Requiring that employees use strong, uniquepasswords for all accounts and enable multi-factor
authentication wherever it’s supported© 2021 Keeper Security, Inc.

4

2021 RANSOMWARE IMPACT REPORTTo Pay or
Not to Pay
While everyone agrees that paying ransoms encourages
further attacks, whether organizations should give
into ransomware demands remains a matter of great
debate even within the security community. This isbecause when an organization is under active attack, itsleadership faces tremendous pressure from customers,company stakeholders, and even cyber insurers to solve
the problem and get back online as quickly as possible.
The pressure is especially intense at healthcare facilities
and in the public sector, where system downtime could
put human health and lives at risk.
As a result, 49% of respondents told Keeper that theiremployers paid the ransom. However, this money didn’t
fall out of the sky: 93% reported that their employers
tightened budgets in other areas following the ransompayment.

© 2021 Keeper Security, Inc.

52021 RANSOMWARE IMPACT REPORTThe High Indirect
Costs of Ransomware

Ransomware recovery extracts highindirect costs.

installing new software and updates was inconvenient or
disrupted productivity.

While stratospheric ransom demands trend on social
media, organizations incur numerous indirect costs
after an attack, particularly involving systems outages.
In addition to frustrating customers and partners, theseoutages prevent employees from doing their jobs.

•	64% of respondents lost login credentials or
documents•	77% respondents were temporarily unable to accesssystems or networks post-attack••

28% of outages lasted for a week or longer•	38% reported experiencing program or application
glitches
33% faced a steep learning curve on new protocols•	40% lost time to frequent computer restarts andupdates•	26% of respondents were unable to fully performtheir job duties for at least a week•	43% had to keep logging into programs/accounts (vs.
staying logged in continuously)

Even once systems are brought back online,
organizations need to make changes to prevent furtherattacks. The overwhelming majority of respondents(83%) said that their organizations installed new
software or made other major updates, such as migratingsome assets to the cloud.

•	21% said their normal online tools and applications
weren’t available anymore

In most cases, rolling out these changes further damaged
productivity and added to the tally of indirect recovery
costs; 71% of respondents said that the process ofUnfortunately, just when employees most needed IT
support to reset their passwords, attempt to recover
lost documents, and get help with new applications andprotocols, IT departments often had their hands full. Over
one-third (36%) of respondents said they had limitedaccess to IT support for non-security related issues
post-attack.

© 2021 Keeper Security, Inc.

6

2021 RANSOMWARE IMPACT REPORT

Percent of Attacks that Are
Not Disclosed
Ransomware attacks are more pervasive because many are not disclosed.
Adding to the pressure that organizational leaders feel to pay the ransom and move on, 64% of respondents felt that
suffering a ransomware attack had a negative impact on their organization’s reputation. Further, 63% of employees
reported that the attack caused them to personally lose trust in their organization.
With this in mind, it’s not surprising that 26% of respondents reported that their employers disclosed the attack only topartners and customers (not the general public), while 15% didn’t tell anyone. This indicates that ransomware attacks
are likely far more pervasive than anyone realizes.

© 2021 Keeper Security, Inc.

7

2021 RANSOMWARE IMPACT REPORT

Full Data

72%

Yes

Q1. Before the attack,did you know what
ransomware was?

No29%

Phishingemail

Q2. What was the root
cause of the ransomware
attack on your company?

42%

Malicious
website23%

Compromisedpassword

21%

Don’tknow
Other

Q3. Has your company
enacted stricter security
protocols as a result of theransomware attack?

Response Findings (Some responses may >100% due to rounding)

10%

4%

87%

Yes

No14%

© 2021 Keeper Security, Inc.

8

2021 RANSOMWARE IMPACT REPORT

Q4. Was your company taken
offline (e.g. unable to accesssystems or networks) for any
period of time because of theransomware attack?

77%

Yes

No23%

Less than
1 hour

Q5. If yes, how long wasyour company down for?

14%

Less than
1 day

30%

Less than
1 week27%

1-2 weeks

14%More than
2 weeks

14%

Wasn’t told

Response Findings (Some responses may >100% due to rounding)3%© 2021 Keeper Security, Inc.

92021 RANSOMWARE IMPACT REPORTLess than
1 hour15%

Less than
1 day

Q6. If yes, how long
were you not able tofully work?

30%

Less than
1 week26%

1-2 weeks

15%More than
2 weeks

11%

Don’t know

Q7. Do you feel that yourorganization’s leadershipcommunicated effectivelywith employees following theransomware attack?

3%

82%

Yes

No19%

Q8. Did your company alert customers and partners of the attack?

70%

15%

15%

Yes

No

Don’t know

Response Findings (Some responses may >100% due to rounding)© 2021 Keeper Security, Inc.

10

2021 RANSOMWARE IMPACT REPORT

Q9. Did your company release a public reactionary statement about the attack?

63%

26%

11%

Yes

No

Don’t know

Q10. Do you feel that theransomware attack negatively
impacted your company’s
reputation?

Yes

Q11. Did the ransomware attack
impact your trust in yourorganization?

Yes

Q12. Prior to the ransomware
attack, did you regularly install
software updates when prompted?

Yes

Response Findings (Some responses may >100% due to rounding)

64%

No

36%

63%

NoNo

37%

81%

19%

© 2021 Keeper Security, Inc.

11

2021 RANSOMWARE IMPACT REPORT

37%

Yes, training

Q13. Following the attack,did your company provide
cybersecurity training orresources?

Yes, resources

26%

Yes, both27%

No

Q14. Following the attack, didyour company install softwareor make other major tech
updates (e.g. moving things tothe cloud)?

Q15. If yes, do you feel theprocess of installing new
software/updates caused any
inconvenience or disrupted
productivity?

Response Findings (Some responses may >100% due to rounding)

10%

83%

Yes

No

17%

71%

Yes

No29%

© 2021 Keeper Security, Inc.

12

2021 RANSOMWARE IMPACT REPORT

Q16. If yes, did you lose any
information, such as login
credentials or documents, in theprocess of updating your devices?

64%

Yes

No36%

Q17. If yes, how do you feel the updates have impacted your daily work routines?

64%

15%

22%

Positively

NegativelyNot at all

49%

Yes

Q18. Did your company
pay the ransom?

No

Don’t know

Response Findings (Some responses may >100% due to rounding)

29%

22%

© 2021 Keeper Security, Inc.

13

2021 RANSOMWARE IMPACT REPORT

Q19. If yes, was theamount disclosed toemployees?

Yes

Q20. If yes, have you noticed
your organization tightening
budgets in other areas
following the payment?

Yes

79%

NoNo

21%

7%

67%

Yes

Q21. Did cybersecurity
spending at your company
increase after the attack?

NoDon’t know

Response Findings (Some responses may >100% due to rounding)

93%

17%

15%

19%

© 2021 Keeper Security, Inc.

14

2021 RANSOMWARE IMPACT REPORT

About Keeper
Keeper protects organizations against ransomware
attacks with robust administration, controls and visibility
over strong password security and real-time dark web
monitoring.
Keeper’s zero-knowledge, enterprise-grade password
security and encryption platform helps thousandsof companies all over the world prevent passwordrelated cyberattacks, improve productivity, and enforce
compliance.
Keeper gives IT administrators complete visibility
into employee password practices, enabling themto monitor adoption of password requirements andenforce password security policies organization-wide,
including strong, unique passwords and multi-factor
authentication (2FA). Fine-grained access controls allow
administrators to set employee permissions based on
their roles and responsibilities, as well as set up sharedfolders for individual groups, such as job classifications
or project teams.
For enhanced protection, organizations can deploy
valuable add-ons such as Keeper Secure File Storage,
which enables employees to securely store and share
documents, images, videos, and even digital certificatesand SSH keys, and BreachWatch™, which scans Dark Web
forums and notifies IT administrators if any employee
passwords have been compromised in a public databreach.
Keeper is SOC-2, FIPS 140-2 and ISO 27001 Certified
and is also listed for use by the Federal government
through the System for Award Management (SAM).
Keeper protects businesses of all sizes across every
major industry sector.
To learn more visit keeper.io/ransomware-impact.

© 2021 Keeper Security, Inc.

15