Over half of businesses hit by ransomware attacks have been forced to shut down operations to recover, with more now reporting significant revenue losses as a result compared to four years ago, according to fresh research from Illumio.

Findings from the security platform provider’s Global Cost of Ransomware Study revealed that 58% of firms that suffered a ransomware attack last year had to halt operations, rising from 45% in 2021, with 40% reporting lost revenue, up from 22%.

Added to that, 41% of firms said they had lost customers as the result of a ransomware attack, and 40% had no choice but to cut their workforce.

The research, based on a survey of over 2,500 IT and cybersecurity professionals around the world, also found that attackers are now more often reaching critical systems to cause maximum disruption, with ransomware impacting 25% of critical systems, causing downtime of twelve hours on average.

Despite 88% of organisations reporting they had fallen victim to an attack, more than half (54%) are still confident in their security position, with a similar number (52%) believing that full and accurate backups are enough of a defence against ransomware. 

However, just 13% of those who suffered a ransomware incident were able to recover all of their data.

Following a ransomware incident, the costs and losses associated with reputation and brand damage now exceed those of legal and regulatory actions, with 35% of organisations experiencing considerable brand damage from an attack – up from 21% in 2021. 

“Ransomware is more pervasive and impactful than ever, with more organisations forced to suspend operations or experiencing major business failure because of attacks,” said Trevor Dearing, director of critical infrastructure at Illumio.

According to the study, the increased connectivity of business systems and devices is making it much harder for organisations to defend these systems against ransomware, especially when it comes to cloud security, with more than a third of respondents (35%) stating that a lack of visibility across hybrid environments makes it difficult to respond to ransomware attacks.

Desktops and laptops remain the most compromised devices (50%), but most attacks moved across the network to infect other devices. In over half of these cases (52%), attackers exploited unpatched systems to move laterally and escalate system privileges, up from 33% in 2021.

Recommended reading

• Report: Vulnerability Exploitation Surge Endangers Cybersecurity
• UK Proposes Ban on Public Sector Ransomware Payments
• Comment | Cybersecurity Ethics in an Age of Evolving Cyber Risk

Illumio’s study found that 44% of businesses lack the ability to quickly identify and contain these attacks, and only around a quarter (27%) have implemented microsegmentation – a vital control for stopping the spread of breaches.

While only 42% of firms have specifically adopted AI to help combat these ransomware attacks, more (51%) are concerned their organisation may experience an AI-generated ransomware attack in the near future.

“Organisations need operational resilience and controls like microsegmentation that stop attackers from reaching critical systems,” continued Dearing. 

“By containing attacks at the point of entry, organizations can protect critical systems and data, and save millions in downtime, lost business, and reputational damage.”

According to an earlier report this month from GuidePoint, 2024 was a record year, with the number of publicly posted ransomware victims reaching 4,848, despite a slump in ransomware cases over Q2 and Q3, the result of the disruption of major ransomware gangs like LockBit and Black Cat.