 |
| Report shows massive impact of ransomware in 2022 |
The 2022 ransomware attack affected more than 200 public sector, government, education, and healthcare organizations in the United States.
Data from public reports, disclosures, leaks posted on the dark web, and third-party analysis indicates that hackers managed to steal data in about half of these ransomware attacks.
According to available data, ransomware attacks in the United States affected 105 counties, 44 universities and colleges, 45 school districts, and 24 healthcare providers.
These statistics, compiled by a cybersecurity company (Emsisoft), confirm that not all victims - to a lesser extent in the public sector and to a greater extent in the private sector - have disclosed such incidents, some of which may have been overlooked.
No clear picture of ransomware attacks
Therefore, we think it would be prudent to be careful with the numbers in the year-end report on the state of ransomware in the US, as they cannot be used to provide clear and accurate information.
However, events affecting the public sector are more likely to be identified, resulting in more consistent data. Because of this, the researchers said the news could be an indication of ransomware activity in the private sector.
"The truth is, no one knows for sure whether the number of attacks is increasing or decreasing," Emsisoft said.
Ransomware attacks on local governments dropped to 105 from 77 in 2021, but remained close to the 113 incidents recorded in previous years.
The researchers note that the 2022 numbers were "significantly affected by an event in Miller County, Arkansas" that spread to computers in 55 different counties.
Emsisoft noted that as of 2022, Quincy County, Massachusetts, is the only local government known to have paid hackers $500,000. In at least 27 of those incidents, hackers also stole victims' data.
The impact of ransomware on the education sector
Ransomware has infected 89 educational institutions, 44 universities and colleges, and 45 school districts in the United States, with hackers stealing data in at least 58 attacks.
While the total number of ransomware attacks in the department was less than 100, the number of potentially affected facilities is over 2,000 when considering the 1,981 affected schools in the school district. One of the main goals for 2022 is the Los Angeles Unified School District.
According to Emsisoft, three educational institutions paid ransoms to the hackers. One of them was the Glenn County Education Office, which paid hackers $400,000 to recover the encrypted data.
Impact on the health sector
In the report, Emsisoft researchers claim that tracking ransomware incidents in healthcare is more difficult, mainly due to unclear detections. For this reason, they only counted attacks on hospitals and multi-hospital health systems, totaling 24 in 2022.
Although small in scale, the impact is much larger, potentially affecting as many as 289 hospitals. The largest healthcare company is Common Spirit Health, which operates more than 140 hospitals and has access to data for 623,000 patients.
Emsisoft researchers said hackers stole files on 17 incidents affecting the healthcare industry.
The company's report stresses that these statistics don't paint a complete picture of ransomware attacks in the public sector, as "there will be incidents that go unnoticed."
In addition, some attacks may be ongoing, unclassified, or not reported at the time of data collection. One such example is CentraState Medical Center, which stopped accepting patients last Friday, December 30, 2022 "due to cybersecurity concerns."
However, the Emsisoft report provides an overview of ransomware activity in the public sector and how it compares to previous years' statistics.