Ransomware and Data Extortion

Chapter 1. Inside the Ransomware Economy

How much money do criminals and hostile state actors make from ransomware attacks? This chapter covers some facts and figures based on recent research.

Cybersecurity Ventures’s “Who’s Who in Ransomware 2023” report predicts that ransomware will cost victim organizations $265 billion annually by 2031, a notable increase from the $5 billion recorded in 2017. Sophos’s white paper “The State of Ransomware 2023” highlights how expensive ransomware can be. The average ransomware payment doubled in a year, from $812,380 in 2022 to a whopping $1,542,333 in 2023. And 40% of organizations that paid a ransom reported making payments of $1 million or more in 2023, compared to just 11% of organizations reporting the same in 2022.

According to ThreatDown’s “2023 State of Ransomware Report”, in the 12-month period between June 2022 and June 2023, there were 1,462 known ransomware attacks in the United States alone. Researchers suspect that many more attacks go unreported. Accurate data is hard to come by when assessing the wider impact of ransomware operations, as most private organizations and individuals are not required to report attacks. For example, the FBI spent seven months in 2022 observing the activities of the infamous Hive ransomware gang after infiltrating their infrastructure. The agency came to the shocking conclusion that only about 20% of attacks were being reported to law enforcement.

Ransomware accounts for 24% of overall cyberattacks ...