OpenText has released its third annual 2024 Global Ransomware Survey, which reveals the current state of ransomware attacks, including ransom payments, the impact of software supply chain attacks and generative AI.

The report found that supply chain attacks are widespread with 62% of respondents having been impacted by a ransomware attack originating from a software supply chain partner in the past year.

With well-funded cyber-criminals increasingly targeting software supply chains and harnessing generative AI to increase phishing attempts, businesses face a persistent struggle to stay ahead of evolving ransomware threats and the rising cost of attacks.

Verizon’s 2024 Data Breach Investigations Report shows that the median loss associated with the combination of ransomware and other extortion breaches has been $46,000 (£35187), ranging between $3 and $1,141,467 (£2.29 to £873,159) for 95% of cases.

The survey reveals that supply chain-related ransomware attacks are a growing concern for organisations.

Nearly 40% of respondents reported being impacted by or unsure if they had experienced a ransomware attack originating from their software supply chain partners. Among those affected by ransomware in the past year, 62% reported that the attack came from a supply chain partner, and 90% plan to enhance collaboration with suppliers to improve security practices.

Concerns about these types of attacks are widespread, with 91% of respondents expressing anxiety about the risks posed by downstream software supply chains and third-party vendors.

Additionally, recent high-profile breaches by companies like Change Healthcare and CDK Global have heightened the urgency of these concerns, with nearly half (49%) of respondents considering vendor changes to mitigate the risks.

Ransomware attacks have been a significant issue across businesses, particularly among SMBs, with 76% of small to medium-sized businesses reporting an attack this year compared to 70% of large enterprises.

Of those who experienced ransomware, nearly half (46%) paid the ransom, with some payments ranging between $1 million (£774,800) and $5 million (£3.8m).

Despite these payments, 97% of affected organisations were able to restore their data. The survey also highlighted the growing threat posed by AI-driven attacks, as more than half of respondents (55%) believe the increased use of AI by cyber-criminals has made their companies more vulnerable. Phishing attacks have also risen, with 69% of those affected by ransomware attributing an increase in phishing incidents to AI technology.

In response to these growing threats, organisations are ramping up investments in cloud security and employee training. Cloud security remains a top priority, with 66% of respondents indicating it as the primary area for cybersecurity investment.

SMBs, in particular, are increasingly focusing on cloud security, with 62% of respondents planning to invest more in 2024, compared to 56% in 2023 and 39% in 2022.

Employee awareness and phishing training have also become more frequent, with 66% of organisations conducting quarterly sessions in 2024, a significant increase from previous years.

Recommended reading

• Ransomware Groups are Adjusting Their Strategies
• NCSC Guide: How To Bridge Cyber With The Boardroom
• NCSC Warns Ransomware Threat to Rise with AI

However, a concerning 26% of companies still lack a formal process for assessing the cybersecurity practices of their software suppliers, leaving a gap in overall supply chain security preparedness.

“SMBs and enterprises are stepping up their efforts against ransomware, from assessing software suppliers to implementing cloud solutions and boosting employee education. However, the increase in organisations paying the ransom only emboldens cybercriminals, fueling more relentless attacks,” said Muhi Majzoub, executive vice president and chief product officer, OpenText.

“Businesses must proactively defend against sophisticated threats like supply chain vulnerabilities and AI-driven attacks, while ensuring resilience through data backups and response plans, to avoid empowering the very criminals seeking to exploit them.”