In the wake of a significant surge in ransomware attacks across the United States in 2021, 2022 appeared to offer a respite with a notable decrease in reported incidents. However, any hopes of a sustained lull were dashed in 2023 as ransomware activity skyrocketed, reaching unprecedented levels.
This surge sets a troubling precedent for the cybersecurity landscape in 2024, suggesting that housing organizations may face even greater threats in the year ahead.
"2022 was really very a quiet year from a ransomware perspective," remarked David Anderson, vice president of cyber liability at Woodruff Sawyer, during a recent webinar discussing trends in cyber insurance.
What is ransomware?
Ransomware, a form of malicious software designed to block access to a computer system or files until a sum of money is paid, has emerged as a formidable threat in recent years. Typically, cybercriminals deploy ransomware through phishing emails or by exploiting vulnerabilities in software. Once infected, victims often find themselves locked out of their own data, facing demands for payment in exchange for decryption keys.
Understanding the ransomware surge
Dan Burke, Woodruff Sawyer's national cyber practice leader, highlighted that the cyber insurance provider's underwriters reported a surge in ransomware claims in the first quarter of 2023. By the summer of that year, "we were hearing about it non-stop," he said, emphasizing that the lull in ransomware in 2022 was evidently not enduring.
In its latest ransomware report, Corvus, a cyber insurance and cyber underwriting firm, declared 2023 a "record-breaking year for ransomware." In 2021, Corvus documented 3,048 ransomware victims whose data was leaked to the dark web, compared to 2,670 in 2022. However, in 2023, the number of leaks surged to 4,496. The report pointed out that ransomware victims who promptly pay the ransom may not appear on leak sites and would not be counted.
Corvus partially attributes the ransomware increase in 2023 to the expansion of the ransomware industry. For instance, 2023 witnessed greater sharing of proprietary encryption software on the dark web, enabling new threat actors to establish their own ransomware groups. Additionally, members of larger ransomware groups are splintering off to initiate their own operations.
"The honing of the ransomware craft dominated 2023, and every indication points to that continued story in 2024," the report states. "While law enforcement actions have been able to throw a wrench in threat actors' plans, this hasn't stopped attackers. The onus is on businesses to bolster security in their own networks."
Cybersecurity resources for housing agencies
For free cybersecurity resources to fortify your housing organization's cybersecurity preparedness, visit HAI Group's Cybersecurity Center. The Multi-State Information Sharing & Analysis Center (MS-ISAC)— operated by the Center for Internet Security and recommended by the U.S. Department of Homeland Security—provides free cybersecurity services to public housing organizations.
If you are considering cyber insurance (which we strongly recommend), please get in touch with a member of our Account Services team—we are here to assist you in securing coverage from a reputable cyber insurance carrier.
This article is for general information only. HAI Group makes no representation or warranty about the accuracy or applicability of this information for any particular use or circumstance. Your use of this information is at your own discretion and risk. HAI Group and any author or contributor identified herein assume no responsibility for your use of this information. You should consult with your attorney or subject matter advisor before adopting any risk management strategy or policy.
