--- title: Why ransomware attacks are on the rise description: Wondering why the threat of ransomware is increasing for organizations? Read on to see why, and learn tips to help mitigate its impact. image: https://shardsecure.com/hubfs/Why-ransomware-attacks-are-on-the-rise%20(2).png --- - [Home](https://shardsecure.com/) - [Blog](https://shardsecure.com/blog) # Why ransomware attacks are on the rise ![Picture of ShardSecure](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/Profile/ShardSecure-Logo__Profile--Purple-Inverted.svg "Picture of ShardSecure") [ShardSecure](https://shardsecure.com) June 27 2022 ![Two corporate office workers discussing ransomware encrypted computers in the occupied glass-walled meeting room behind them.](https://shardsecure.com/hubfs/Why-ransomware-attacks-are-on-the-rise%20(2).png "Two corporate office workers discussing ransomware encrypted computers in the occupied glass-walled meeting room behind them.") Wondering why the threat of ransomware is increasing for organizations? Like us, you've likely noticed that ransomware is in the news more and more lately. Major attacks have been hitting Fortune 500 companies, hospitals, factories, [government agencies](https://www.securityweek.com/ransomware-hit-200-us-gov-education-and-healthcare-organizations-2022), [colleges and universities](https://shardsecure.com/blog/class-is-in-session), and more, and they show no signs of slowing down. We're here to break down why ransomware attacks are on the rise — and what can be done about it. ## What is ransomware? Ransomware is a type of malware that prevents users from accessing their systems and files and requires them to pay a ransom to regain access. Most types of ransomware encrypt hard drive files so they can’t be accessed, although “locker ransomware” may [erase files or block access to a system](https://www.cisecurity.org/insights/blog/ransomware-facts-threats-and-countermeasures) using other methods. After encrypting systems, ransomware attackers demand a payment — usually in the form of Bitcoin or other cryptocurrencies — in exchange for a decryption key that will unlock the affected material. They may also threaten to [sell or leak confidential data](https://www.cisa.gov/stopransomware/ransomware-faqs) or delete system backups as an added incentive to make victims pay the ransom. [Ransomware ](https://www.malwarebytes.com/ransomware)can infect a system when users: - open malicious attachments in spam emails, often as a result of phishing - visit compromised websites - are redirected to cybercriminal servers by online ads, a.k.a. drive-by downloads - are tricked into opening attachments or clicking on links via social engineering Ransomware is of growing concern and has the potential to cause tremendous damage to small businesses and Fortune 1000 companies alike. Below, we’ll outline how and why the threat of ransomware is rising — and what your organization can do to mitigate its effects. ### How are ransomware attacks rising? Although early versions of ransomware has been around since the late 1980s, the problem has only recently become a major threat. According to the Verizon Business 2022 Data Breach Investigations Report, [ransomware breaches have increased more this year](https://www.verizon.com/business/resources/reports/dbir/) than the last five years combined. Similarly, Check Point Research discovered a [24% global increase ](https://www.cybertalk.org/2022/05/18/a-third-of-companies-hit-with-ransomware-didnt-have-to-pay-heres-how-they-did-it/)in ransomware attacks this year, with one in 53 organizations affected in 2022 versus one in 66 in 2021. Ransomware attacks are not only becoming more prevalent; they’re also becoming more costly. According to the same Check Point Research report, 11% of organizations paid ransoms of $1 million or more, and the average ransom paid out by companies increased nearly five-fold to $812,360. As a result, we've seen more [high-profile ransomware cases](https://www.pbs.org/newshour/nation/why-ransomware-attacks-are-on-the-rise-and-what-can-be-done-to-stop-them) like the 2021 attack on the US-based software company Kaseya, where attackers compromised between 800 and 1,500 companies and requested a $70 million payment as ransom. Around the same time, the Colonial Pipeline ransomware attack caused panic buying at gas stations and necessitated a $5 million payment in Bitcoin. Meanwhile, the world’s largest meat supplier paid an $11 million ransom in Bitcoin after another[ attack that same month](https://fortune.com/2022/02/17/ransomware-attacks-surge-2021-report/#:~:text=The%20increase%20in%20ransomware%20was,perpetuating%20that%20behavior%2C%20PBS%20reported.). The impact of ransomware is being felt well beyond private corporations. In June 2022, Costa Rica’s national public health agency was attacked by ransomware. And ransomware attacks on health organizations can be particularly devastating; according to a recent report by SC Media,[ it costs around $1.85 million ](https://www.scmagazine.com/resource/in-focus-mdr-for-healthcare)on average to recover ransomware-infected systems in the healthcare sector. Unfortunately, the problem shows no sign of abating. A report from Cybersecurity Ventures predicts that, [by 2031, ransomware will cost the economy around $265 billion each year](https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/), with a new attack happening every two seconds. ## Why is ransomware on the rise? Several different factors have contributed to the recent explosion of ransomware. From the effects of the COVID-19 pandemic and the growth of cryptocurrency to companies’ own evolving responses to ransomware, the changing digital landscape has created a perfect storm for ransomware. ### Remote work First, the increase in remote work has been a major boon for cybercriminals. Employees accessing the internet at home are much more vulnerable to attack, since they typically lose the protection of company firewalls and secure internet routers outside of their office networks. Additionally, the increasing amount of confidential data stored in multi-cloud environments leaves companies more vulnerable to exposure. As a December 2021 [Forbes article put it](https://www.forbes.com/sites/forbestechcouncil/2021/12/06/at-the-crossroads-of-identity-the-relationship-between-remote-work-and-ransomware/?sh=54e250d8721c), “Remote work has left exposed access credentials littered across the enterprise.”  Although some companies require their remote employees to use virtual private networks (VPNs) and virtual desktop infrastructure (VDI), these measures are less effective with cloud-based resources. Furthermore, using a remote desktop protocol (RDP) can allow attackers to gain control of devices that belong to IT admins and other privileged teams.  The ransomware economy has been quick to adapt. The criminal landscape now includes “initial access brokers” who seek out vulnerable and exposed VPN and RDP access credentials and then sell them to the highest bidder to perpetrate more  attacks. ### Growth of cryptocurrency Another major factor in the rise of ransomware is the [growing popularity of cryptocurrenc](https://www.pbs.org/newshour/nation/why-ransomware-attacks-are-on-the-rise-and-what-can-be-done-to-stop-them)y. From Ethereum and Dogecoin to USD Coin and Binance Coin, cryptocurrencies are typically regarded as harder to trace than other forms of payment. While crypto transactions are not always untraceable in reality, the perception of anonymity has emboldened attackers to demand high payments. Ransomware criminals often require that their victims pay them in Bitcoin, with some even including step-by-step instructions to help users create Bitcoin wallets.  Cryptocurrency also offers [great ease and speed](https://www.npr.org/2021/06/10/1004874311/how-bitcoin-has-fueled-ransomware-attacks) in transferring millions of dollars across national borders, facilitating money laundering and making it harder to catch cybercriminals in the act. ### More companies are paying ransoms Just like a schoolyard bully taking someone’s lunch money, cybercriminals are emboldened by past successes. The more companies that pay their ransoms, the more likely they are to continue with ransomware attacks — and the more likely other criminals are to follow suit.  Unfortunately, the number of organizations paying ransoms is growing. A recent report from the Institute for Security and Technology found that the number of victims paying the ransom increased more than 300% from 2019 to 2020 alone. Although this figure is discouraging, it also makes sense: many organizations feel they have no choice but to pay when faced with the loss of irreplaceable systems and files.  Luckily, there are many effective ways to protect against ransomware. With the right preparation and security measures, organizations can avoid paying ransoms and even maintain business continuity in the event of an attack. ## How to mitigate the impact of ransomware First, organizations must conduct a cybersecurity risk analysis and develop an incident response plan that includes ransomware events. Make sure that this plan allows your company to quickly isolate and remove the ransomware threat and restore normal operations. Next, consider investing in insurance policies that cover cyberattacks. Cyber insurance has become an increasingly common and sophisticated product, and it can provide critical risk mitigation for ransomware, malware, and other online attacks. Below, we’ll cover a few more steps your organization can take to protect itself against the growing threat of ransomware. ### Beware of phishing Even with the growing sophistication of malware, most ransomware attacks are effective for one main reason: human error. As Deloitte notes, [the number one delivery vehicle for ransomware](https://www2.deloitte.com/lu/en/pages/risk/articles/phishing-ransomware-how-to-prevent-threats.html) is clicking a link or downloading an attachment in a phishing email.  Today, many phishing emails are successful because they effectively impersonate a trusted coworker or a contact who the user actually knows. Increasingly sophisticated social engineering on the part of attackers makes it easier for even tech-savvy users to be tricked into clicking compromised links. To protect against phishing, organizations may employ anti-spam solutions and include warning banners when emails are coming from someone outside of the organization. It’s also important to warn employees that cybercriminals are able to create very authentic-looking phishing emails — sometimes even customized with information that those same employees posted publicly on their social media accounts. All in all, an abundance of caution will help organizations avoid falling prey to phishing attacks. ### Prepare for an attack The Center for Internet Security and the Cybersecurity and Infrastructure Security Agency recommend a [number of additional steps](https://www.cisecurity.org/insights/blog/ransomware-facts-threats-and-countermeasures) that organizations can take [to prepare for a ransomware event](https://www.cisa.gov/stopransomware/ransomware-faqs): - Create multiple iterations of backups, store them offline, and routinely test them for data integrity. - Keep all systems and devices patched and updated, including cloud locations. - Employ antivirus, ad-blocker, and anti-spam solutions to prevent phishing emails and dangerous links from reaching the network. - Implement employee training and regularly remind workers of the dangers of clicking on unknown links and opening attachments in unsolicited emails. - Apply the principles of least privilege and network segmentation. ## Use ShardSecure to mitigate the impact of ransomware The ShardSecure platform helps organizations [mitigate the impact of ransomware](https://shardsecure.com/resources/briefs/mitigate-cloud-ransomware) and protect sensitive data from double extortion attacks. With multiple data integrity checks, our technology outomatically reconstructs and relocates data compromised by ransomware. With virtual clusters that deploy on-prem or in the cloud, the platform also offers high availability during attacks and other disruptions. Interested in learning more about how ShardSecure can help your organization mitigate the impact of ransomware and maintain business continuity? Visit our [resources page](https://shardsecure.com/resources) today. ### Sources [Ransomware Hit 200 US Gov, Education and Healthcare Organizations in 2022 | Security Week](https://www.securityweek.com/ransomware-hit-200-us-gov-education-and-healthcare-organizations-2022 ) [Ransomware: Facts, Threats, and Countermeasures | Center for Internet Security](https://www.cisecurity.org/insights/blog/ransomware-facts-threats-and-countermeasures)  [Ransomware FAQs | Cybersecurity and Infrastructure Security Agency](https://www.cisa.gov/stopransomware/ransomware-faqs)  [How to Protect Against Ransomware | Malware Bytes](https://www.malwarebytes.com/ransomware) [2022 Data Breach Investigations Report | Verizon](https://www.verizon.com/business/resources/reports/dbir/) [A Third of Companies Hit With Ransomware Didn’t Have To Pay | CyberTalk.org](https://www.cybertalk.org/2022/05/18/a-third-of-companies-hit-with-ransomware-didnt-have-to-pay-heres-how-they-did-it/) [Why Ransomware Attacks Are on the Rise — and What Can Be Done To Stop Them | PBS NewsHour](https://www.pbs.org/newshour/nation/why-ransomware-attacks-are-on-the-rise-and-what-can-be-done-to-stop-them) [There’s a Huge Surge in Hackers Holding Data for Ransom, and Experts Want Everyone To Take These Steps | Fortune.com](https://fortune.com/2022/02/17/ransomware-attacks-surge-2021-report/#:~:text=The%20increase%20in%20ransomware%20was,perpetuating%20that%20behavior%2C%20PBS%20reported) [Global Ransomware Damage Costs Predicted To Exceed $265 Billion By 2031 | Cybercrime Magazine](https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/) [Phishing and Ransomware — How Can You Prevent These Evolving Threats? | Deloitte Luxembourg](https://www2.deloitte.com/lu/en/pages/risk/articles/phishing-ransomware-how-to-prevent-threats.html) [At the Crossroads of Identity: The Relationship Between Remote Work and Ransomware | Forbes](https://www.forbes.com/sites/forbestechcouncil/2021/12/06/at-the-crossroads-of-identity-the-relationship-between-remote-work-and-ransomware/?sh=54e250d8721c) [How Bitcoin Has Fueled Ransomware Attacks | NPR](https://www.npr.org/2021/06/10/1004874311/how-bitcoin-has-fueled-ransomware-attacks) [Ransomware](https://shardsecure.com/blog/tag/ransomware) ## Read on ![](https://shardsecure.com/hubfs/Picture2.jpg) June 15 2026 ### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) [Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) February 18 2026 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) [Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) November 12 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) [Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png) October 16 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) [Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png) October 1 2025 | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity) ### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data) [Read more](https://shardsecure.com/blog/sensitive_data) ![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg) September 15 2025 | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news) ### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership) [Read more](https://shardsecure.com/blog/entrust_partnership) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg) July 29 2025 | [Ransomware](https://shardsecure.com/blog/tag/ransomware) ### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine) [Read more](https://shardsecure.com/blog/ransomware-fine) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg) July 29 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data) [Read more](https://shardsecure.com/blog/ai-unstructured-data) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg) July 22 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach) [Read more](https://shardsecure.com/blog/sharepoint_breach) [![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/) 101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America [![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877) © 2026 ShardSecure®. All rights reserved. [Privacy Policy](https://shardsecure.com/privacy-policy) ![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "ShardSecure", "url" : "https://shardsecure.com/blog/author/shardsecure" }, "dateModified" : "2023-09-11T15:02:59.658Z", "datePublished" : "2022-06-27T12:00:55.000Z", "headline" : "Why ransomware attacks are on the rise", "image" : [ "https://shardsecure.com/hubfs/Why-ransomware-attacks-are-on-the-rise%20(2).png" ], "mainEntityOfPage" : { "@id" : "https://shardsecure.com/blog/why-ransomware-on-the-rise", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg" }, "name" : "ShardSecure" } } ```