Ransomware statistics:

Who is targeted
the most?

There are several ways to classify ransomware. The most popular one differentiates between malware that encrypts your data (crypto ransomware) and malware that only locks your screen (ransom lockers).

• Crypto ransomware

As the research suggests, this is the most prominent type of ransomware today. It uses modern cryptographic algorithms to encrypt the victim’s data and offers a decryptor — at a price.

• Ransom lockers

Instead of using encryption to prevent the victim’s access to their files, ransom lockers block the entire device. The ransom note will instruct the user to make a payment within 48 hours and sometimes even prohibit turning off their device. In this case, the victim cannot use the machine until they pay a ransom or until the timer runs out and the data is publicized or wiped completely.

Ransomware attacks use technology to infiltrate, steal, and encrypt data as well as use psychological tricks to scare, humiliate, or fool the victim into paying the ransom. Here’s how a typical case might go:

1. The malware infiltrates the device. This can be done by executing an attack against a specific person or launching a broad phishing campaign. Usually, one wrong click by the victim is enough to perform the attack.

2. The malware encrypts the device. It can sit on the device for days sending the data to cybercriminals or attack immediately.

3. The malware displays the ransom note. Different tactics can be at play here. The attackers may pose as law enforcement agents claiming they blocked the device because of some illegal content. They may also openly admit they’re after a ransom. The note always includes instructions on how to purchase and transfer cryptocurrency. It may also have a timer that increases the ransom amount at intervals putting more pressure on the victim to pay up.

4. If the timer runs out, the malware will wipe your drive, publish the data, or both. However, even in cases where ransomware is paid, there is no guarantee the device will be unlocked.

Based on this research and the cases made public throughout the decades, anyone can be targeted. Cases involving big-name companies and huge ransom demands may get more publicity, but ransomware affects both individuals and companies of all sizes. Government institutions and infrastructure also frequently end up in the crosshairs of cybercriminals.

Recently, the attacks got bolder and more frequent. You may have heard of these cases or have even been affected by them. For example, the 2021 Colonial Pipeline ransomware case impacted millions of consumers and businesses. Eventually, the privately-held company was forced to pay $5 million to get its systems back.

A few months after the Colonial Pipeline ransomware attack, there was another, even a bigger one. Cybercriminals targeted Kaseya, a major software supplier, gaining access to the data of thousands of other companies around the world. While the ransom demand was $70 million, the company claims they did not pay and instead acquired a universal decryptor from a third party.