KRITIS increasingly targeted by ransomware

Advertising

Companies in the KRITIS energy and water sectors have a significantly higher attack rate of 67 percent than the global average (59 percent). 55 percent needed more than a month to recover after the attack. Findings from the Sophos report "The State of Ransomware in Critical Infrastructure 2024".

The results of its industry study entitled “The State of Ransomware in Critical Infrastructure 2024” speak for themselves: water, energy, oil and gas are among the sixteen critical infrastructure sectors defined by CISA, which are examined in more detail in the study.

Restoration costs quadrupled to 2,8 million euros

🔎 The critical energy and water sectors have a significantly higher attack rate of 67 percent than the global average of 59 percent (Image: Sophos).

The results of the survey of 5.000 cybersecurity/IT executives worldwide, 275 of whom are in the KRITIS sector, show that the average restoration costs for the two infrastructure sectors of energy and water quadrupled to 2,8 million euros last year. This means that the costs in this sector are around four times higher than the global and cross-sector average (median).

"Cybercriminals are focusing on industry sectors where they cause the most pain and disruption. At the same time, the public, especially in the critical infrastructure environment, is demanding quick solutions to restore services - even paying ransoms if necessary. This makes utilities prime targets for ransomware attacks," says Chester Wisniewski, Global Field CTO. "Unfortunately, utilities are vulnerable to attacks in many ways, including high availability requirements and a physical security-focused engineering mindset. Added to this are some older technologies without modern security and a general lack of IT security staff."

Almost half of the attacks were carried out through exploited vulnerabilities

In addition to rising recovery costs, the median ransom payments for organizations in the energy and water sectors also rose to more than €2,3 million in 2024. This is around €460.000 higher than the global, cross-sector average. The two sectors also reported the second highest rate of ransomware attacks in 67 at 2024 percent - compared to the cross-industry average of 59 percent. In addition, 49 percent of ransomware attacks on these two critical infrastructure sectors began with an exploited vulnerability.

Energy and water utilities are also reporting increasingly longer recovery times. Only 20 percent of companies affected by ransomware were able to recover in a week or less in 2024, compared to 41 percent in 2023 and 50 percent in 2022. Fifty-five percent needed more than a month to recover, compared to 36 percent in 2023. In comparison, across all sectors, only 35 percent of companies needed more than a month to recover.

Highest rate of compromised backups, increasing recovery times

When considering the ability to recover quickly, intact backups play a crucial role. The two critical infrastructure sectors reported the highest rate of compromised backups (79 percent) and the third highest rate of malicious encryption (80 percent) compared to the other industries studied.

"An increasing number (61 percent) paid the ransom as part of their recovery strategy, yet recovery took longer. Paying large ransoms not only encourages cybercriminals to carry out more attacks, but it also prevents organizations from achieving their desired goal of faster recovery time," said Wisniewski. "Utilities should take active steps to monitor their remote access and network systems for vulnerabilities. They should ensure they have XNUMX/XNUMX monitoring and response capabilities to minimize outages and reduce recovery times. Incident response plans should be planned in advance, just as they are for fires, floods, hurricanes and earthquakes, and rehearsed regularly."

background to the study

Data for the State of Ransomware in Critical Infrastructure 2024 report comes from 275 respondents across the energy, oil and gas, and utilities sectors, which are part of the power and water sectors. The results of this industry survey are part of a broader, independent survey of 5.000 cybersecurity/IT executives conducted across 2024 countries and 14 industries between January and February 15.

Matching articles on the topic