NEW YORK—Global financial services firms spent more than $2 million on average recovering from a ransomware attack last year, according to new analysis from Sophos.
The U.K. security vendor polled 550 IT decision-makers in mid-sized financial sector firms around the globe to compile its State of Ransomware in Financial Services 2021.
It found 34% of firms in the vertical were hit by ransomware in 2020, with 51% admitting their attackers managed to encrypt data, reported Info Security in it analysis.
However, although 62% reported they were able to restore scrambled data from backups, the recovery costs ascribed to victim organizations from the sector were much higher than the average across all verticals ($1.85 million).
“The figure is also surprising considering that only a quarter (25%) of financial services victims paid the ransom demand — the second-lowest payment rate of all industries surveyed and below the global average of 32%,” Info Security stated.
Reason for Costs
Sophos said the high cost of recovery is partly due to the highly regulated nature of the sector, with firms forced to adhere to multiple compliance mandates, including PCI DSS, SOX and GDPR.
“Strict guidelines in the financial services sector encourage strong defenses. Unfortunately, they also mean that a direct hit with ransomware is likely to be very costly for targeted organizations,” said John Shier, senior security advisor, Sophos. “If you add up the price of regulatory fines, rebuilding IT systems and stabilizing brand reputation, especially if customer data is lost, you can see why the survey found that recovery costs for mid-sized financial services organizations hit by ransomware in 2020 were in excess of $2 million.”