In 2024, ransomware groups claimed responsibility for 5,461 successful ransomware attacks on organizations worldwide. Of these 1,204 were confirmed by the targeted organizations, according to analysis by Comparitech.
Across the 1,204 confirmed attacks, 195.4 million records have been breached. These figures for 2024 are lower than those recorded in 2023 (1,474 attacks affecting 261.5 million records), though they are expected to rise as reports often come in months later.
The total ransom paid across these attacks was $133.5M. RansomHub was the most prolific gang (89 confirmed attacks) followed by LockBit (83), Medusa (62), and Play (57).
The top three breaches last year were Change Healthcare in the US with an estimated 100 million people caught up in this February 2024 breach via ALPHV/BlackCat. Change Healthcare is also reported to have paid the gang $22M only for another gang (RansomHub) to claim ALPHV had pulled the rug on its affiliates. In second place LoanDepot, also in the US saw 16.9 million affected, the $6M ransom demand wasn’t paid, however. In third MediSecure suffered the largest breach in Australia’s history with 12.9 million affected. MediSecure was hit by an attack in May 2024. Threat actor Ansgar claimed the attack and listed the stolen data for sale at $50,000.
Healthcare was the most targeted sector overall with 181 attacks confirmed, followed by government agencies on 179, manufacturing on 142 and education on 116.
Looking ahead Rebecca Moody, head of data research at Comparitech, says, “Based on 2024, it’s highly likely we’ll continue to see large-scale attacks that either cause widespread disruption to companies and/or see troves of data being stolen. What’s more, Clop’s recent Cleo exploit looks set to see a number of companies issuing breaches in the coming months (the gang threatened to release around 66 companies toward the end of 2024).”
You can read more on the Comparitech site.
Image credit: AndreyPopov/depositphotos.com
