Telecom
Ransomware Recovery Cost Reaches Nearly $2 Million- Sophos Survey Shows
Sophos, a global leader in next-generation cybersecurity, today announced the findings of its global survey, “The State of Ransomware 2021,” which reveals that the average total cost of recovery from a ransomware attack has more than doubled in a year, increasing from $761,106 in 2020 to $1.85 million in 2021.
The average ransom paid is $170,404. The global findings also show that only 8% of organizations managed to get back all of their data after paying a ransom, with 29% getting back no more than half of their data.
The survey polled 5,400 IT decision makers in mid-sized organizations in 30 countries across Europe, the Americas, Asia-Pacific and Central Asia, the Middle East, and Africa.
While the number of organizations that experienced a ransomware attack fell from 51% of respondents surveyed in 2020 to 37% in 2021, and fewer organizations suffered data encryption as the result of a significant attack (54% in 2021 compared to 73% in 2020), the new survey results reveal worrying upward trends, particularly in terms of the impact of a ransomware attack.
“The apparent decline in the number of organizations being hit by ransomware is good news, but it is tempered by the fact that this is likely to reflect, at least in part, changes in attacker behaviors,” said Chester Wisniewski, principal research scientist, Sophos. “We’ve seen attackers move from larger scale, generic, automated attacks to more targeted attacks that include human hands-on-keyboard hacking. While the overall number of attacks is lower as a result, our experience shows that the potential for damage from these more advanced and complex targeted attacks is much higher. Such attacks are also harder to recover from, and we see this reflected in the survey in the doubling of overall remediation costs.”
The main findings of the State of Ransomware 2021 global survey include:
· The average cost of remediating a ransomware attack more than doubled in the last 12 months. Remediation costs, including business downtime, lost orders, operational costs, and more, grew from an average of $761,106 in 2020 to $1.85 million in 2021. This means that the average cost of recovering from a ransomware attack is now 10 times the size of the ransom payment, on average
· The average ransom paid was $170,404. While $3.2 million was the highest payment out of those surveyed, the most common payment was $10,000. Ten organizations paid ransoms of $1 million or more
· The number of organizations that paid the ransom increased from 26% in 2020 to 32% in 2021, although fewer than one in 10 (8%) managed to get back all of their data
“The findings confirm the brutal truth that when it comes to ransomware, it doesn’t pay to pay. Despite more organizations opting to pay a ransom, only a tiny minority of those who paid got back all their data,” said Wisniewski.
“This could be in part because using decryption keys to recover information can be complicated. What’s more, there’s no guarantee of success. For instance, as we saw recently with DearCry and Black Kingdom ransomware, attacks launched with low quality or hastily compiled code and techniques can make data recovery difficult, if not impossible.”
· More than half (54%) of respondents believe cyberattacks are now too advanced for their IT team to handle on their own
· Extortion without encryption is on the rise. A small, but important 7% said that their data was not encrypted, but they were held to ransom anyway, possibly because the attackers had managed to steal their information. In 2020, this figure was 3%
“Recovering from a ransomware attack can take years and is about so much more than just decrypting and restoring data,” said Wisniewski. “Whole systems need to be rebuilt from the ground up and then there is the operational downtime and customer impact to consider, and much more. Further, the definition of what constitutes a ‘ransomware’ attack is evolving. For a small, but significant minority of respondents, the attacks involved payment demands without data encryption.
“This could be because they had anti-ransomware technologies in place to block the encryption stage or because the attackers simply chose not to encrypt the data. It is likely that the attackers were demanding payment in return for not leaking stolen information online. A recent example of this approach involved the Clop ransomware gang and a known financially-motivated threat actor hitting around a dozen alleged victims with extortion-only attacks.
“In short, it is more important than ever to protect against adversaries at the door, before they get a chance to take hold and unfold their increasingly multi-faceted attacks. Fortunately, if organizations are attacked, they don’t have to face this challenge alone. Support is available 24/7 in the form of external security operations centers, human-led threat hunting and incident response services.”
The main findings of the State of Ransomware 2021 for Nigeria:
· 22% of respondents from Nigeria had experienced a ransomware attack in the last 12 months, compared to 53% in 2020
· 39% of respondents from Nigeria that weren’t hit by ransomware in the last 12 months but expect to be hit in the future, believe that ransomware attacks are getting increasingly hard to stop due to their sophistication
· 26% of respondents from Nigeria that weren’t hit by ransomware in the last 12 months but expect to be hit in the future, say it is hard to stop their users from compromising the organization’s security
Sophos recommends the following six best practices to help defend against ransomware and related cyberattacks:
1. Assume you will be hit. Ransomware remains highly prevalent. No sector, country or organization size is immune from the risk. It’s better to be prepared, but not hit, rather than the other way round
2. Make backups and keep a copy offline. Backups are the main method organizations surveyed used to recover their data after an attack. Opt for the industry standard approach of 3:2:1 (three sets of backups, using two different media, one of which is kept offline)
3. Deploy layered protection. As more ransomware attacks also involve extortion, it is more important than ever to keep adversaries out in the first place. Use layered protection to block attackers at as many points as possible across an estate
4. Combine human experts and anti-ransomware technology. The key to stopping ransomware is defense in depth that combines dedicated anti-ransomware technology and human-led threat hunting. Technology provides the scale and automation an organization needs, while human experts are best able to detect the tell-tale tactics, techniques and procedures that indicate an attacker is attempting to get into the environment. If you don’t have the skills in house, look at enlisting the support of a specialist cybersecurity company – Security Operation Centers (SOCs) are now realistic options for organizations of all sizes
5. Don’t pay the ransom. Easy to say, but far less easy to do when an organization has ground to a halt due to a ransomware attack. Independent of any ethical considerations, paying the ransom is an ineffective way to get data back. If you do decide to pay, bear in mind that the adversaries will restore, on average, only two-thirds of your files
6. Have a malware recovery plan. The best way to stop a cyberattack from turning into a full breach is to prepare in advance. Organizations that fall victim to an attack often realize they could have avoided significant financial loss and disruption, if they had an incident response plan in place
The State of Ransomware 2021 survey report is available in full on Sophos.com.
The State of Ransomware 2021 survey was conducted by Vanson Bourne, an independent specialist in market research, in January and February 2021. The survey interviewed 5,400 IT decision makers in 30 countries, in the US, Canada, Brazil, Chile, Colombia, Mexico, Austria, France, Germany, the UK, Italy, the Netherlands, Belgium, Spain, Sweden, Switzerland, Poland, the Czech Republic, Turkey, Israel, UAE, Saudi Arabia, India, Nigeria, South Africa, Australia, Japan, Singapore, Malaysia, and the Philippines. All respondents were from organizations with between 100 and 5,000 employees.
Sophos Intercept X protects users by detecting the actions and behaviors of ransomware and other attacks.
Bosun Tijani, minister of Communications, Innovation and Digital Economy, yesterday claimed that bandits and terrorists are able to communicate and coordinate their activities with ease because they exploit gaps in the country’s telecommunications network.
Bosun Tijani, minister of Communications, Innovation and Digital Economy,
Tijani, who spoke Politics Today, a Channels Television’s programme, on Friday, Tijani said the criminals exploit gaps in the country’s telecommunications network.
He also claimed the bandits use advanced technology to bounce calls across multiple towers in areas with poor connectivity.
“They weren’t using the normal towers; they bounced calls off multiple towers, which is why they favor areas that are largely unconnected,” he said.
When asked about reports that unregistered or fraudulently registered SIM cards are still in use despite the Bank Verification Number (BVN) and the National Identification Number (NIN)–Subscriber Identity Module linkage policies, Tijani said the issue is technically complex and the reports are not fully verified.
“Whether it’s fact or not, I do not know where you’re getting that from, and I do not know who has evidence that there are people with unregistered SIMs,” he added.
The minister stated that the federal government is investing in telecom towers in underserved regions, upgrading the country’s communication satellites to improve coverage, and expanding fiber-optic networks to strengthen the country’s digital infrastructure.
“If our towers are not working, our satellites will work. Nigeria is the only country in West Africa with communication satellites, and we are bringing new satellites to upgrade their capabilities,” Tijani said.
He added that these initiatives aim to ensure better connectivity for Nigerians while closing loopholes that criminals exploit, thereby enhancing national security.
The minister’s comments come amid rising concerns over insecurity in several parts of the North, where banditry, kidnapping, and terrorism have escalated in recent years.
There are also reports of bandits flaunting ransom payments on social media platforms such as TikTok, raising alarm among authorities and the public
Sophos, a global leader of innovative security solutions for defeating cyberattacks, has announced its best-ever results in the MITRE ATT&CK Enterprise 2025 Evaluation.
MITRE ATT&CK Enterprise 2025 Evaluation
Sophos XDR detected 100% of adversary behaviors (sub-steps)1 across two complex attack scenarios: Scattered Spider, which Sophos X-Ops tracks as GOLD HARVEST, a financially motivated cybercriminal collective, and Mustang Panda, which Sophos X-Ops tracks as BRONZE PRESIDENT, a People’s Republic of China (PRC) espionage group.
The Scattered Spider scenario included activity across Windows, Linux, and AWS cloud environments, and the Mustang Panda scenario focused on Windows only.
Further, Sophos achieved the highest-possible “Technique”-level rating for 86 out of 90 total sub-steps in the evaluation, by generating high-fidelity detections with details on execution, impact, and adversary behavior, providing clear who, what, when, where, how, and why insights.
Sophos XDR achieved:
- 100% detection coverage1 for all 90 adversary sub-steps across two complex attack scenarios across Windows, Linux, and AWS cloud environments
- Highest possible (“Technique”) ratings for 86 of 90 sub-steps, demonstrating deep visibility and actionable detections
- Highest possible (“Technique”) ratings for 61 out of 62 of sub-steps in the Scattered Spider scenario involving identity abuse, cloud exploitation, and data exfiltration
“Scattered Spider and Mustang Panda represent distinct threat profiles that challenge defenders in very different ways,” said Simon Reed, chief research and scientific officer, Sophos. “Achieving full detection coverage against both validates the accuracy and depth of Sophos’ analytics and demonstrates how the company’s AI-native XDR platform converts complex telemetry into clear, actionable intelligence, helping security teams detect, understand, and stop advanced attacks with confidence.
“Sophos’ consistently strong performance in these rigorous evaluations underscores the power and precision of our threat detection and response capabilities, and our commitment to stopping the world’s most sophisticated cyberthreats.
“Over the five years that Sophos has participated in ATT&CK Evaluations, we have continually invested in strengthening our platform, and that investment has translated into stronger results year after year – both in the evaluations, and in the security outcomes we deliver for our customers.”
These results demonstrate the power of the Sophos XDR platform to defend against sophisticated cyber threats. Every day, Sophos processes 223+ terabytes of telemetry in Sophos Central, generating 34+ million detections and automatically blocking 11+ million threats.
This scale of customer insights ensures that Sophos’ detections are being tested and improved to provide continuous protection while delivering stronger outcomes for organizations worldwide.
Understanding The Threat Actors
Sophos X-Ops has tracked GOLD HARVEST (Scattered Spider) since 2022, observing a loosely affiliated cybercriminal collective driven by both financial motives and a desire to elevate their reputations on underground forums.
Despite several arrests, operators and associates continue to launch high-profile attacks across the U.K. and U.S., at times partnering with major Russian-speaking ransomware groups.
Their sophisticated social engineering capabilities enable them to compromise even well-defended organizations, underscoring the importance of strong behavioral detections within modern security operations.
In parallel, Sophos X-Ops has monitored BRONZE PRESIDENT (Mustang Panda) for many years.
This long-running PRC espionage group conducts intelligence-led operations that align closely with priorities of China’s Ministry of State Security. Recent targeting includes activity against Tibetan communities surrounding the Dalai Lama’s 90th birthday, as well as intrusions on Thai government and military offices during periods of heightened regional tension.
BRONZE PRESIDENT remains one of the most active and persistent state-aligned threat actors operating today.
MITRE ATT&CK Evaluations are among the world’s most rigorous independent security tests.
They emulate the tactics, techniques, and procedures (TTPs) used by real-world adversaries to assess each participating vendor’s ability to detect, analyze, and articulate threats in alignment with the MITRE ATT&CK Framework.
These evaluations continually strengthen Sophos’ capabilities for the benefit of the organizations it protects. This was the seventh round of MITRE’s “Enterprise” ATT&CK Evaluation, a product-focused assessment designed to help organizations better understand how security operations solutions like Sophos EDR and Sophos XDR can help them defend against sophisticated, multi-stage attacks.
When evaluating EDR or XDR solutions, Sophos recommends reviewing MITRE ATT&CK Evaluations alongside other independent proof points.
Central Bank of Nigeria (CBN) on Thursday announced plans to partner with the Nigerian Communications Commission (NCC) to develop an industry-wide short code for consumers to lodge complaints with financial institutions anytime, anywhere, even without internet access.
CBN
Dr Aisha Isa-Olatinwo, CBN Director, Consumer Protection and Financial Inclusion Department, disclosed this at a virtual Consumer Protection Town Hall meeting titled “Ask the Regulator”, organised by Enhancing Financial Inclusion and Advancement (EFInA).
She said the initiative addresses challenges faced by vulnerable consumers using feature phones who often have to visit bank branches physically to report issues amid the convergence of telecom and banking services.
Isa-Olatinwo said the CBN had achieved 94 per cent month-on-month timely resolution of consumer complaints, adding that the apex bank had streamlined processes and partnered with banks to balance consumer protection with financial system stability.
An EFInA poll presented at the event revealed that 61 per cent of respondents experienced failed transactions in the past 12 months, while 26 per cent had reversals within 24 hours and 54 per cent between 24 and 48 hours.
Other complaints included six per cent for fraud, 14 per cent for hidden charges and 15 per cent for poor customer service, with 66 per cent of respondents aware of complaint escalation steps.
President of Consumer Advocacy Foundation of Nigeria (CAFON), Mrs Sola Salako-Ajulo, lamented that consumers often feel unprotected and urged introduction of fraud insurance for instant reversals, shifting the burden of proof from customers.
She said: “What is missing in our system—unlike more developed economies—is fraud insurance, where banks reverse reported fraud immediately, refund consumers, and investigate later.”
Mr Ajibade Laolu-Adewale, Chairman of Committee of e-Business Industry Heads (CeBIH), represented by Mr Adeyemi Salisu, stressed that banks must resolve disputes between acquiring and issuing banks without redirecting customers to merchants.
The short code initiative is expected to enhance financial inclusion by providing accessible redress mechanisms in Nigeria’s evolving digital payment ecosystem.
NCC Blocks Piracy Sites as Nollywood Faces Rising Digital Theft
Minister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers
FIRS says MOU with DGFIP Won’t Compromise Nigeria Tax Data Sovereignty
Top Nigerian Startups Secure Funding Boost @ iHatch Demo Day Awards
Four Must-Watch African Films Debut Free on Glo TV
Kaspersky Introduces Cyber Pathways to Support Career Development in Cybersecurity
Hackers Breach Phones of Dangote and Otedola, Demand Ransom
Nigeria Records Highest Weekly Cyberattacks in Africa — Report
Banks Lost N3.3Bn to Fraud in Q1 of 2025 – FITC
MTN Nigeria Has Invested Over ₦32.23 Billion in National Priorities Through Its Foundation
Telecom2 days agoMTN Nigeria Launches Unlimited 5G Broadband Plans to Boost Digital Inclusion
News2 days agoFRC, ICPC Seal Anti-corruption Alliance
News2 days agoDebt Rises in AI Data Centre Boom
Telecom2 days agoMoMo PSB Brings Relief to UNILAG Students with Ultra-Cheap Bus Fares
E-Financial2 days agoSterling Bank, Pan-Atlantic University Partner to Certify Non-Oil Export Academy Graduates
Broadcasting2 days agoYoung Africans Hit Hardest by Online Gender Violence, Paradigm Initiative Reports
General News2 days agoFidelity Bank to Host Virtual Masterclass on New Tax Law
Telecom1 day agoMinister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers