The State of Ransomware in
Critical Infrastructure 2024
Findings from an independent, vendor-agnostic survey of 5,000 leaders
responsible for IT/cybersecurity, including 275 from the energy, oil/gas andutilities sector, across 14 countries, conducted in January-February 2024.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Introduction
Sophos’ annual study of the real-world ransomware experiences of organizations
around the globe explores the full victim journey, from root cause to severity of
attack, financial impact, and recovery time. This report focuses on the ransomware
experiences of the energy, oil/gas and utilities sector, a core element of the criticalinfrastructure supporting businesses around the globe.
The report combines fresh new insights, including an exploration of the role of law
enforcement in ransomware remediation, with year-on-year trends leveraging
learnings from our previous studies. It reveals the realities facing energy, oil/gas andutilities providers today and how the impact of ransomware has evolved over the last
five years.

A note on reporting dates
To enable easy comparison of data across our annual surveys, we name the reportfor the year in which the survey was conducted: in this case, 2024. We are mindfulthat respondents are sharing their experiences over the previous year, so many of
the attacks referenced occurred in 2023.

About the survey
The report is based on the findings of an independent, vendor-agnostic survey
commissioned by Sophos of 5,000 IT/cybersecurity leaders across 14 countries
in the Americas, EMEA, and Asia Pacific. This included 275 respondents from theenergy, oil/gas and utilities organizations. All respondents represent organizations
with between 100 and 5,000 employees. The survey was conducted by research
specialist Vanson Bourne between January and February 2024, and participants
were asked to respond based on their experiences over the previous year.

A Sophos Whitepaper. July 2024

	5,000

respondents

275

from the energy, oil/gas
and utilities industry

14

countries

100-5,000

	employee organizations(50% 100-1,000, 50% 1,001-5,000)

15

industry segments

The State of Ransomware in Critical Infrastructure 2024

Rate of Ransomware Attacks in Critical
Infrastructure
67% of energy, oil/gas and utilities organizations were hit by ransomware in thelast year, level with the rate in 2023. In contrast, the global cross-sector attack rate
declined slightly, with 59% experiencing an attack, down from 66% in the previous
two years.

2020

2021

2022

2023

2024

55%

36%

75%

67%

67%

In the last year, has your organization been hit by ransomware?
Yes. n=275 (2024), n=150 (2023), 357 (2022), 197 (2021), 204 (2020)

See the appendix for a detailed breakdown of the rate of ransomware attacks byindustry.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Percentage of Computers Impacted inCritical Infrastructure
On average, 62% of computers in energy, oil/gas and utilities are impacted by aransomware attack, considerably above the cross-sector average of 49%. Unlike
other sectors where only a small percentage of organizations have their fullenvironment encrypted, approximately one in five energy, oil/gas and utilities
organizations (17%) reported that 91% or more of their devices were impacted.
At the other end of the scale, while some attacks do impact only a handful ofdevices, this is highly unusual, with only 2% of affected organizations saying thatfewer than 1% of their devices were affected.

Energy, oil/gas and utilities is the sector with the highest percentage of devices
impacted by an attack, on average, followed by healthcare (58%). Both industries
are challenged by higher levels of legacy technology and infrastructure controls
than most other sectors, which likely makes it harder to secure devices, limit lateral
movement, and prevent attacks from spreading. IT, technology and telecoms
reported the smallest percentage of devices impacted (33%), reflecting the strong
cyber posture that is often seen in this sector.
See the appendix for a detailed breakdown of the percentage of computers impacted
by industry.

Proportion of
respondents
20%
18%

18%

17%

16%
14%

14%
13%

12%
10%
9%

8%

8%

8%

6%
5%

4%
2%

4%
2%

2%

0%
Less than 1%

1-10%

11-20%

21-30%

31-40%

41-50%

51-60%

61-70%

Percentage of devices impacted in the victim organization
What percentage of your organization’s computers were impacted by ransomware in the last year? n=183 energy, oil/gas and utilities organizations hit by ransomware

A Sophos Whitepaper. July 2024

71-80%

81-90%

91-100%

The State of Ransomware in Critical Infrastructure 2024

Root Causes of Ransomware Attacks in
Critical Infrastructureroot cause (32%) of ransomware attacks and compromised credentials in second
position (29%).

All energy, oil/gas and utilities organizations hit by ransomware were able toidentify the root cause of the attack. Exploited vulnerabilities (49%) topped the list
as the most common attacker entry method in 2024, followed by compromised
credentials, used in over one in four attacks (27%). While the running order of the fourmost common root causes remains consistent with our 2023 study, the proportionof attacks starting with the exploitation of unpatched vulnerabilities has increased
considerably over the last year.

Overall, energy, oil/gas and utilities is the sector most likely to fall victim to the
exploitation of unpatched vulnerabilities. Government organizations are particularly
vulnerable to attacks that start with abuse of compromised credentials: 49%(state/local) and 47% (central/federal) of attacks began with the use of stolen login
data. IT, technology and telecoms and retail both reported that 7% of ransomware
incidents began with a brute force attack – it may be that their reduced exposure tounpatched vulnerabilities and compromised credentials forces adversaries to focus,
in part, on other approaches.

The entry methods reported by energy, oil/gas and utilities are in line with theglobal cross-sector, which also has exploited vulnerabilities as the most common

See the appendix for a detailed breakdown of the rate of the root cause of attack byindustry.
35%

Exploited vulnerability

49%

31%

Compromised credentials

27%

24%

Malicious email

14%

7%
7%

Phishing

1%

Download2%

3%

Brute force attack

1%

0%

10%

20%

30%

Percentage of attacks
2024

2023

Do you know the root cause of the ransomware attack your organization experienced in the last year? Yes. n=183 energy, oil/gas, and utilities organizations hit by ransomware

A Sophos Whitepaper. July 2024

40%

50%

60%

The State of Ransomware in Critical Infrastructure 2024

Backup Compromise in Critical Infrastructure
98% of energy, oil/gas and utilities organizations hit by ransomware in the past year
said that the cybercriminals attempted to compromise their backups during theattack. Four in five (79%) of these backup compromise attempts were successful –the highest rate of successful backup compromise across all sectors.
Energy, oil/gas and utilities organizations that had their backups compromised
reported considerably worse outcomes than those whose backups were notbreached:Ì Ransom demands were, on average, more than double that of those whose
backups weren’t impacted ($2.5M vs. $5.5M median initial ransom demand)Ì Organizations whose backups were compromised were considerably
more likely to pay the ransom to recover encrypted data (64% vs. 39%)
Ì Median overall recovery costs came in 4X more than that of those that
did not have backups compromised ($3,000,000 vs. $750,000)

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Rate of Data Encryption in Critical
Infrastructure
80% of ransomware attacks on energy, oil/gas and utilities organizations resulted indata encryption in our 2024 study, in line with the encryption rate reported by this
sector in 2023 (79%) and higher than the 2024 cross-sector average of 70%.
1% of energy, oil/gas and utilities organizations also experienced an extortion-based
attack, where the data was not encrypted but they were held to ransom anyway.

Across sectors, energy, oil/gas and utilities reported one of the highest rates of dataencryption (joint with central/federal government) after state/local government(98%) and lower education (85%). Financial services (49%) followed by retail (56%)
reported the lowest rates of data encryption. Distribution and transport is the sector
most likely to have experienced an extortion-based attack, with 17% saying that data
was not encrypted but they were held to ransom anyway – almost three times therate of any other sector.
See the appendix for a detailed breakdown of the data encryption rates by industry.

80%

80%

79%
70%

66%

28%

25%

19%

18%

19%

8%
3%
2020 (n=113)
Data was encrypted2%2021 (n=71)2022 (n=268)

The attack was stopped before data was encrypted

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Base number in chart

A Sophos Whitepaper. July 2024

2%2023 (n=101)1%2024 (n=183)

Data was not encrypted but we were still held to ransom (extortion)

The State of Ransomware in Critical Infrastructure 2024

Data TheftAdversaries don’t just encrypt data; they also steal it. Energy, oil/gas and utilities
organizations reported that in 50% of the incidents where data was encrypted,
data was also stolen – higher than the 36% reported last year. Data theft increases
attackers’ ability to extort money from their victims, while also enabling them tofurther monetize the attack by selling the stolen data on the dark web.

50%of ransomware attacks where data was encryptedreported that data was also stolen.

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Yes. Yes, and the data wasalso stolen (n=183)

Across sectors, energy, oil/gas and utilities fares second worst on propensity tohave data exfiltrated as well as encrypted, with only the IT, technology and telecoms
sector (53%) reporting a higher rate. Conversely, the education sector is least likely
to report data theft in an attack, with higher education reporting the lowest overall
propensity to have data encrypted and stolen (18%), followed by lower education,
which shares the second spot with healthcare (both 22%).

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Data Recovery
Almost all energy, oil/gas and utilities organizations (99%) that had data encrypted
got their data back. Of them, 61% paid the ransom to get encrypted data back,whereas only 51% restored encrypted data using backups – the lowest rate of
backup use reported across all sectors. This is the first time that energy, oil/gas andutilities organizations have reported a higher propensity to pay the ransom than use
backups.

Use backups torestore data

51%

Paid the ransomand got data back61%

Use other means
to get data back24%

24% of the energy, oil/gas and utilities organizations used other means to get databack – while the survey did not explore this area further, this could include working
with law enforcement or using decryption keys that had already been made public.
This year’s findings represent a marked change from the previous two years when
the sector enjoyed impressive rates of backup use (70% in 2023 and 77% in 2022).
80%
70%

Used backups

70%
61%

60%
55%
50%

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore thedata (n=146)

77%

Paid the ransom

50%

51%

2022
(n=188)2023(n=80)

2024(n=146)40%
30%

Used backups

Paid the ransom

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore thedata. Base numbers in chart.

A notable change over the last year is the increase in the propensity for victims touse multiple approaches to recover encrypted data (e.g., paying the ransom andusing backups). This time, 35% of energy, oil/gas and utilities organizations that had
data encrypted reported using more than one method, higher than the 26% reported
in 2023.
See the appendix for a detailed breakdown of the data recovery method by industry.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Ransom Demands

These huge demands are not exclusive to the energy, oil/gas and utilities sector,
with all named sectors (excluding "other") reporting median ransom demands of$1M or higher. Central/federal government reported the highest median ($7.7M) andmean ($9.9M ) demands, whereas retail and IT, technology and telecoms received
the lowest median demands ($1M), followed by construction ($1.1M).

This year, for the first time, we included both ransom demands and payments in thisreport. Across the 132 energy, oil/gas and utilities organizations that had their dataencrypted and were able to share the attackers' initial ransom demand, the average
ask was $2.54M (median) and $3.9M (mean).

See the appendix for a detailed breakdown of ransom demands by industry.

One of the most notable findings in this year’s study is that 71% of ransom demands
made to energy, oil/gas and utilities organizations are for $1M or more, with onequarter of the demands (24%) for $5M or more.

Percentage of demands for the ransom amount

47%

24%

7%
3%
0%

0%

Less than$1,000Between$1,000 and$4,999.99

Between$5,000 and$9,999.99

Between$10,000 and$19,999.99

7%
2%

3%

Between$20,000 and$49,999.99

Between$50,000 and$99,999.99

2%
Between$100,000 and$249,999.99

Ransom demand amountHow much was the ransom demand from the attacker(s)? n=132

A Sophos Whitepaper. July 2024

5%

Between$250,000 and$499,999.99

Between$500,000 and$999,999.99

Between$1,000,000 and$4,999,999.99$5 million or
moreThe State of Ransomware in Critical Infrastructure 2024

Ransom Payments
86 energy, oil/gas and utilities respondents whose organizations paid the ransom
shared the actual sum paid.
Ì Median payment: $2,540,000
Ì Mean payment: $3,225,093
Ransom payments vary considerably by industry. IT, technology and telecoms
reported the lowest median ransom payment ($300,000), followed by distribution
and transport ($440,000). At the other end of the scale, both lower education andcentral/federal government paid median ransoms of $6.6M.
See the appendix for a detailed breakdown of average ransom payment by industry.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Propensity to Negotiate Ransom Amounts in
Critical Infrastructure
The study has revealed that energy, oil/gas and utilities victims don’t always pay the
initial sum demanded by the attackers. A little less than half (48%) of respondents
said their payment matched the original request. 26% paid less than the original
demand, and 27% paid more.
Propensity to Negotiate Ransom AmountPaid LESS than the original demand
Paid MORE than the original demand
Paid the ORIGINAL demand27%

How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to theattackers? n=86.

A Sophos Whitepaper. July 2024

Conversely, the sectors most likely to pay more than the original demand are thosewith a high proportion of public sector organizations:Ì Higher education is most likely to pay more than the original demand (67% paidmore), and least likely to pay less than the original demand (20% paid less)Ì Healthcare was second most likely to pay more than the original demand(57% paid more), fol-lowed by lower education (55% paid more)

26%
48%

Looking at the data by industry, energy, oil/gas and utilities has the highest
propensity to pay the original ransom amount demanded by attackers. It is also thesector with the second lowest propensity to pay less than the original demand.

It may be that these industries are less able to access professional ransom
negotiators to help reduce their costs. They may also have a greater need to recover
the data "at any cost" due to their public remit. Either way, it’s clear that there is roomfor negotiation between the original demand and the eventual payment.
See the appendix for a detailed breakdown of ransom demand vs. ransom payment
by industry.

The State of Ransomware in Critical Infrastructure 2024

Source of Ransom Funding in Critical
Infrastructure
Who provides the money for the ransom is an area of considerable interest, and thestudy has revealed a number of insights in this area:
Ì Funding the ransom is a collaborative effort, with energy, oil/gas and utilities
respondents re-porting multiple sources of monies in 82% of casesÌ The primary source of ransom funding in energy, oil/gas and utilities
organizations is the organization itself, covering 39% of the payment on average;
the organization’s parent company and/or governing body typically provides 21%
Ì Insurance providers are heavily involved in ransom payments, contributing in 83%
of cases. 19% of total ransom payment funding comes from insurance providers

Ransom Transaction Execution
While multiple bodies can contribute to the ransom, funds are typically transferred ina single payment by one party.
In the energy, oil/gas and utilities sector, the victim organization made two-thirds(67%) of the transactions – the highest across all sectors. Insurance providers
transferred the funds for over one-fifth (21%) of ransom payments, either directly(17%) or through their appointed incident response specialist (4%). 7% were
executed by the victim’s legal firm.
Only 8% (with rounding) of transfers were made by incident response specialists,
whether appointed by the insurance provider (4%) or another party, typically thevictim (3%).
Executor of ransom payment transfer

Source of Ransom Payment Funding
Organization

3% 1%

Organization’s cyber insurance provider
7%

21%

Organization
39%

Cyber insurance provider
Parent company/governing body

21%

Incident response specialist provided
by the organization’s cyber insurance
provider4%

Personal finances of an individual
19%

From which of the following source(s) was the money to fund the ransom payment obtained? n=89

17%

Organization’s legal firm
67%

Incident response specialist notprovided by the organization’s cyber
insurance provider
Individual who used their personal
finances to help fund the ransom
payment

Who made the ransom payment transaction i.e., who transferred the money to the attacker’s account? n=89.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Recovery Costs in Critical Infrastructure
Ransom payments are just one element of recovery costs when dealing withransomware events. Excluding any ransoms paid, in 2024, energy, oil/gas andutilities organizations reported a mean cost of $3.12M to recover from a ransomware
attack, very similar to the $3.17M reported in our 2023 survey.
In contrast, the cross-sector average showed a 50% increase in recovery costs,
coming in at $2.73M in 2024, an increase of almost $1M from 2023 ($1.82M)

2021

2022

2023

2024

$1.54M$1.58M$3.17M$3.12M

What was the approximate cost to your organization to rectify the impacts of the most significant ransomware attack(considering downtime, people time, device cost, network cost, lost opportunity etc.)? n=183 (2024)/101 (2023)/ 268(2022)/ 71 (2021). N.B. 2022 and 2021 question wording also included “ransom payment”.

The median recovery cost data for energy, oil/gas and utilities organizations revealed
a 4X increase, from $750,000 in 2023 to $3,000,000 in 2024. These figures are
considerably above the cross-sector average where median recovery costs doubled
from $375,000 to $750,000 over the last year.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Recovery Time in Critical Infrastructure
The time taken to recover from a ransomware attack is steadily increasing in energy,
oil/gas and utilities organizations. Our 2024 research revealed:This slowdown may reflect the increased complexity and severity of attacks,
necessitating greater recovery work. It may also indicate a growing lack of recovery
preparation.

Ì 20% of ransomware victims in energy, oil/gas and utilities are fully
recovered in a week or less, down from 41% in 2023 and 50% in 2022
Ì 55% in energy, oil/gas and utilities now take more than a month
to recover, up from 36% in 2023 and 19% in 2022

39%

32%

31%

31%

25%

24%
20%

19%

18%

16%

16%

16%

9%

4%
1%
Less than a day

Up to a week

Up to 1 monthTime to fully recover from the ransomware attack

2024 (n=183)

2023 (n=101)2022 (n=268)

How long did it take your organization to fully recover from the ransomware attack? Base numbers in chart.

A Sophos Whitepaper. July 2024

1-3 months

3-6 months

The State of Ransomware in Critical Infrastructure 2024

Involvement of Law and Order in Critical
Infrastructure
The nature and availability of official support when dealing with a ransomware
attack vary on a country-by-country basis, as do the tools to report a cyberattack. US
victims can leverage the Cybersecurity and Infrastructure Security Agency (CISA);
those in the UK can get advice from the National Cyber Security Centre (NCSC); andAustralian organizations can call on the Australian Cyber Security Center (ACSC), toname but a few.

Reflecting the normalization of ransomware, 99% of energy, oil/gas and utilities
organizations that were hit by ransomware engaged with law enforcement and/or
official government bodies due to the attack. 54% reported that they received advice
on dealing with the attack, 68% got help investigating the attack, and 46% said theyreceived help recovering data encrypted in the attack.

68%

54%
46%

They gave us advice on
dealing withthe attack

They helped us toinvestigate theattackThey helped us torecover data encryptedin the attack

0%

1%

1%

They were involved inother ways

They were not involved
because we did notreport the attack

They were not involved
although we did report
the attack

How law enforcement and/or government bodies were involved
If your organization reported the attack to law enforcement and/or an official government body, how did they get involved? n=183.

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Ease of Engagement in Critical Infrastructure
Just over half (54%) of those who engaged with law enforcement and/or official
bodies in relation to the attack said the process was easy (20% very easy, 34%
somewhat easy). 20% said the process was very difficult, while 27% described it assomewhat difficult. While it is encouraging that some found the process easy, thereis clearly room to improve the engagement experience for the sector.

20%

20%

Very difficult
Somewhat difficult
Somewhat easy

34%

27%

Very easy

How easy or difficult was it for your organization to engage with law enforcement and/or official bodies in relation to theattack? n=182 (excluding ”don’t know” responses).

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Conclusion

About Vanson Bourne

Ransomware remains a major threat to energy, oil/gas and utilities organizations of
all sizes around the globe. While the attack rate globally has dropped, energy, oil/gas
and utilities experienced the same frequency of attacks as last year. Additionally, theimpact of an attack on energy, oil/gas and utilities organizations that fall victim has
increased, with the sector reporting one of the highest rates of data encryption andthe recovery time from a ransomware attack increasing. As adversaries continue toiterate and evolve their attacks, it’s essential that defenders and their cyber defenses
keep pace.

Vanson Bourne is an independent specialist in market research for the technology
sector. Their reputation for robust and credible research-based analysis is founded
upon rigorous research principles and their ability to seek the opinions of seniordecision-makers across technical and business functions, in all business sectors
and all major markets. For more information, visit www.vansonbourne.com

Prevention. The best ransomware attack is the one that didn’t happen because theadversaries couldn’t get into your organization. With around half of the attacks (49%)
starting with the exploitation of unpatched vulnerabilities in energy, oil/gas andutilities, it’s important to take control of your attack surface and deploy risk-basedprioritization of patching. The use of MFA to limit credential abuse should also be apriority for every single organization. Ongoing user training on how to detect phishingand malicious emails remains essential.
Protection. Strong foundational security, including endpoint, email, and firewall
technologies, is a must. Endpoints (including servers) are the primary destination
for ransomware actors, so ensure they are well-defended, including dedicatedanti-ransomware protection to stop and roll back malicious encryption. Security
tools need to be correctly configured and deployed to provide optimal protection, so
look for solutions that deploy out of the box with straightforward posture controls.
Protection that is complicated and hard to deploy can easily increase risk rather than
reduce it.
Detection and response. The sooner you stop an attack, the better. Detecting andneutralizing an adversary inside your environment before they can compromise yourbackups or encrypt your data will considerably improve your outcomes.
Planning and preparation. Having an incident response plan that you are wellversed in deploying will greatly improve your outcomes if the worst happens and you
experience a major attack. Regularly practice restoring data from backups to ensure
speed and fluency should you need to execute in the aftermath of an attack.
To explore how Sophos can help you optimize your ransomware defenses, speak to
an adviser or visit www.sophos.com

A Sophos Whitepaper. July 2024

The State of Ransomware in Critical Infrastructure 2024

Appendix
Rate of Ransomware Attacks by Industry
Percentage of organizations hit by ransomware in the last year

80%

69%

69%

67%
60%

60%

71%
62%

79%

70%
62%

64%

63%

58%

55%
50%

65%

64%

65%

66%

67% 67%

67%

70% 68%

60%
56%

50%

45%

34%

State/local
government(n=270)2023

Retail(n=577)

Business andpro. Services(n=257)IT, technology
and telecoms(n=262)Distribution
and transport(n=250)Construction
and property(n=250)Media,
leisure andentertainment(n=253)Lower
education(n=300)2024

In the last year, has your organization been hit by ransomware? Yes. n=5,000 (2024) n=3,000 (2023). 2024 industry base numbers in chart.

A Sophos Whitepaper. July 2024

Other(n=170)

Manufacturing
andproduction(n=585)

Financialservices(n=592)Highereducation(n=300)

Energy, oil/gas
and utilities(n=275)

Healthcare(n=402)Central/federalgovernment(n=257)

The State of Ransomware in Critical Infrastructure 2024

Percentage of Computers Impacted by Industry
Percentage of devices impacted

62%

50%
43%

44%

45%

Financialservices(n=387)

Manufacturing
andproduction(n=378)Other(n=108)

52%

52%

52%

53%

Business andpro. Services(n=128)Lower
education(n=190)Distribution
and transport(n=149)Construction
and property(n=154)

54%

55%

56%

58%

40%
33%

IT, technology
and telecoms(n=143)Retail(n=261)Highereducation(n=197)

Central/federalgovernment(n=175)What percentage of your organization’s computers were impacted by ransomware in the last year? n=2,974 organizations hit by ransomware. Industry base numbers in chart.

A Sophos Whitepaper. July 2024

Media,
leisure andentertainment(n=157)

State/ local
government(n=93)

Healthcare(n=271)

Energy, oil/gas
and utilities(n=183)

The State of Ransomware in Critical Infrastructure 2024

Root Cause of Attack by Industry
Business and pro. services (n=128)

34%

Central/federal government (n=175)

23%

Construction and property (n=154)

21%

35%
47%

Healthcare (n=271)

34%

Higher education (n=197)

Manufacturing and production (n=378)

State/local government (n=93)

Compromised credentials

A Sophos Whitepaper. July 2024

30%

Malicious email

Phishing

8%

25%

7%

15%
16%

36%

Do you know the root cause of the ransomware attack your organization experienced in the last year? n=2,974 organizations hit by ransomware.

8%
10%

49%

30%

7%

15%

29%

20%

15%
Brute force attack

4%

11%

26%

22%

24%

Other (n=108)
Exploited vulnerability

25%

32%

21%

20%

38%

9%

22%

44%

Media, leisure and entertainment (n=157)

19%

23%
25%

27%

7%
12%

34%

28%

Retail (n=261)

14%
27%

42%

Lower education (n=190)

23%

27%
30%

5%

4%

16%

49%
27%

7%

18%

23%

Energy, oil/gas and utilities (n=183)

IT, technology and telecoms (n=143)

23%

36%

8%

18%

27%

Distribution and transport (n=149)

Financial services (n=387)

22%

Download

4%
15%
Unknown

5%

The State of Ransomware in Critical Infrastructure 2024

Data Encryption Rate by Industry

5%
17%

19%
27%

2%

6%

14%

19%

21%

25%

31%

24%

22%

41%

15%

31%

39%

46%

98%
80%
73%

85%

80%
69%

77%

74%

68%

74%

76%

57%

62%

56%

49%

Business andpro. Services(n=128)Central/federalgovernment(n=175)Construction
and property(n=154)

Data was encrypted

Distribution Energy, oil/gas
and transport and utilities(n=149)(n=183)Financialservices(n=387)

Healthcare(n=271)

The attack was stopped before data was encrypted

Did the cybercriminals succeed in encrypting your organization’s data in the ransomware attack? Base number in chart.

A Sophos Whitepaper. July 2024

Highereducation(n=197)IT, technology
and telecoms(n=143)Lower
education(n=190)

Manufacturing
Media,
andleisure andproduction entertainment(n=378)(n=157)Retail(n=261)

State/ local
government(n=93)

Data was not encrypted but we were still held to ransom (extortion)

Other(n=108)

The State of Ransomware in Critical Infrastructure 2024

Data Recovery Method by Industry
Percentage that got encrypted data back that used the recovery method

81%
78%
74%

73%

62%

61%
58%

58%
51%

53%

74%

73%
67%

66%
59%

78%

75%

60%

60%

62%

61%

69%

62%
58%

54%
51%

48%
43%

43%

39%

Central/federalgovernment(n=140)Distribution
and transport(n=101)

Construction
and property(n=106)IT, technology
and telecoms(n=81)

Paid the ransom and got data backFinancialservices(n=189)Healthcare(n=201)

State/ local
government(n=91)

Other(n=67)

Retail(n=146)

Business and Energy, oil/gas Manufacturing
professional
and utilities
andservices(n=146)
production(n=93)(n=278)Used backups to restore the data

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes, we used backups to restore the data. Base numbers in chart. Ordered by propensity to pay the ransom.

A Sophos Whitepaper. July 2024

Lower
education(n=162)Highereducation(n=152)

Media,
leisure andentertainment(n=119)

The State of Ransomware in Critical Infrastructure 2024

Ransom Demand by Industry
Ransom demand$9,874,553$7,700,000$5,862,053$5,087,940$4,520,009$4,141,911$4,065,732$4,641,273$4,905,159$4,795,235$3,909,637$3,850,000$4,000,000$3,550,000$3,300,000$3,246,937$2,984,908$2,882,370$2,837,175$2,609,224$2,532,583$2,540,000$2,000,000$2,200,000$1,500,000$1,000,000$1,000,000$1,100,000$1,155,000$680,000

Other(n=55)MedianIT, technology
and telecoms(n=70)

Retail(n=131)

Construction
Media,
Manufacturing
and property
leisure andand(n=89)
entertainment production(n=106)(n=227)

Financialservices(n=165)Mean

How much was the ransom demand from the attacker(s)? Base numbers in chart. Ordered by median demand.

A Sophos Whitepaper. July 2024

Business and Energy, oil/gas Distribution
pro. Services
and utilities and transport(n=66)(n=132)(n=86)

State/local
government(n=60)

Highereducation(n=130)Lower
education(n=154)

Healthcare(n=155)Central/federal
government(n=75)

The State of Ransomware in Critical Infrastructure 2024

Ransom Payment by Industry
Ransom payment$7,408,688$6,600,000$7,460,007$6,600,000$5,852,461$5,261,248$4,410,000$4,402,330$4,173,184$3,312,416$3,225,093$3,040,958$2,992,594$2,743,732$2,496,301$2,229,621$2,540,000$2,367,061$2,229,116$2,000,000$2,000,000$2,200,000$1,470,000$946,000$300,000$440,000$1,050,000$465,000

IT, technology Distribution
and telecoms and transport(n=35)(n=43)Median$950,000$1,200,000

Other(n=32)Media,
leisure andentertainment(n=81)

Retail(n=78)

Construction Manufacturing
and property
and(n=46)
production(n=157)

Healthcare(n=99)

Mean

How much was the ransom payment that was paid to the attackers? Base numbers in chart. Data ordered by median payment.

A Sophos Whitepaper. July 2024

Business andpro. Services(n=55)

Financialservices(n=90)

State/local
government(n=49)

Energy, oil/gas
and utilities(n=86)

Highereducation(n=92)

Central/federal
government(n=55)

Lower
education(n=99)

The State of Ransomware in Critical Infrastructure 2024
Proportionof ransom
demand paid

Ransom Demand vs. Ransom Payment by Industry
Business and pro. Services (n=55)

67%

Central/federal government (n=55)

50%

Construction and property (n=46)

Healthcare (n=99)

50%
32%

111%

13%

122%

37%

82%

55%

13%

65%

Manufacturing and production (n=157)
47%

Media, leisure and entertainment (n=81)

8%
23%

53%

Retail (n=78)

Percentage that paid LESS than the original demand

13%

35%

Percentage that paid MORE than the original demand

How much was the ransom demand from the attacker(s)? How much was the ransom payment that was paid to the attackers? Base numbers in chart.

70%

84%
20%

19%

115%

95%

34%

45%
56%

27%
30%

14%

75%

15%

67%

IT, technology and telecoms (n=35)

Other (n=32)

18%

57%

20%

State/local government (n=49)

101%

15%

28%

Lower education (n=99)

95%

48%

67%

103%
95%

28%

27%

Financial services (n=90)

A Sophos Whitepaper. July 2024

36%

36%

26%

74%
8%

22%

36%

Energy, oil/gas and utilities (n=86)

18%

42%

42%

Distribution and transport (n=43)

Higher education (n=92)

16%

26%

104%
79%

Percentage that paid the ORIGINAL demand

The State of Ransomware in Critical Infrastructure 2024

Sophos delivers industry leading cybersecurity solutions to businesses of all sizes, protecting them in real time from advanced threatssuch as malware, ransomware, and phishing. With proven next-gen capabilities your business data is secured effectively by productsthat are powered by artificial intelligence and machine learning.
© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-07-10 WP-EN (PC)