Ransomware Threats Surge in India: OpenText Survey Reveals
Software supply chain accounted for 99 per cent of ransomware attacks faced by the respondents in the past year. 50 per cent of ransom payments were between $1 million and $10 million. Nearly 98 per cent claimed to have successfully restored their organisation’s data
image for illustrative purpose
Hyderabad: OpenText on Wednesday released its third annual 2024 Global Ransomware Survey, which reveals the current state of ransomware attacks, including ransom payments, the impact of software supply chain attacks and generative AI. The report found that supply chain attacks are widespread with 90 per cent of Indian respondents having been impacted by a ransomware attack originating from a software supply chain partner in the past year. With well-funded cybercriminals increasingly targeting software supply chains and harnessing generative AI to increase phishing attempts, businesses face a persistent struggle to stay ahead of evolving ransomware threats and the rising cost of attacks.
"Small and medium businesses (SMBs) and enterprises are stepping up their efforts against ransomware, from assessing software suppliers to implementing cloud solutions and boosting employee education. However, the increase in organisations paying the ransom only emboldens cybercriminals, fuelling more relentless attacks," said Muhi Majsoub, executive vice president and chief product officer, OpenText. “Businesses must proactively defend against sophisticated threats like supply chain vulnerabilities and AI-driven attacks, while ensuring resilience through data backups and response plans, to avoid empowering the very criminals seeking to exploit them."
Key survey findings include:
• Respondents are overwhelmingly concerned about supply chain attacks. Those who reported a ransomware attack this year were more likely to report that it came from their supply chain.
• Almost two thirds (62 per cent) of respondents have been impacted by a ransomware attack originating from a software supply chain partner or were unsure about it.
• Of the respondents who experienced a ransomware attack in the past year, 99 per cent have been impacted by a ransomware attack originating from a software supply chain partner and 96 per cent are planning to increase collaboration with software suppliers to improve security practices in the next year.
• A majority (95 per cent) of respondents are concerned about ransomware attacks on a company’s downstream software supply chain, third-party and connected partners.
When asked if recent breaches by key industry vendors like Change Healthcare, Ascension and CDK Global that caused sector-specific outages and losses made them more concerned about being impacted by a supply chain attack, more than three quarters (76 per cent) are concerned enough to consider changing vendor.
• Almost all respondents (94 per cent), including those who have experienced a ransomware attack in the past year, have a formal process for assessing the cybersecurity practices of your software suppliers. And only 6 per cent do not or don’t know.
• A vast majority of companies (90 per cent) have experienced a ransomware attack in the past one year, with more SMBs than large enterprises having experienced an attack.
• Of the 68 per cent of respondents who have experienced a ransomware attack, 90 per cent have experienced a ransomware attack in the last year and only 10 per cent have not.
• Of those who experienced a ransomware attack in the past year, almost three-quarters of respondents (72 per cent) paid the ransom. Half (50 per cent) of their ransom payments were between $1 million and $10 million. At the same time, almost all (98 per cent) successfully restored their organisation’s data.
• Respondents experienced more phishing attacks due to the increased use of AI, especially among those who have experienced a ransomware attack.
• 69 per cent of respondents said their company is more at risk of suffering a ransomware attack because of the increased use of AI among threat actors.
• Almost three-quarters (71 per cent) of respondents have observed an increase in phishing attacks due to the increased use of AI.
• Organisations, including SMBs, continue to invest more in cloud security and security awareness and phishing training.
• Cloud security is the cybersecurity area that respondents say their companies are investing in most (76 per cent).
• A majority (96 per cent) of respondents said their companies require employees to participate in security awareness or phishing training. In 2024, 43 per cent conducted monthly training.
Survey Methodology
OpenText Cybersecurity polled 1,781 c-level executives, security professionals and security and technical directors from SMBs and enterprises in the United States, the United Kingdom, Australia, France, Germany and India from August 23 to September 10, 2024. Respondents represented multiple industries including technology, financial services, retail, manufacturing, healthcare, education and more.
