Ransomware, is a type of malicious software (malware) that takes a user's data hostage by encrypting it. The cybercriminals then demand payment of a ransom to provide the decryption key needed to recover the data.
This type of threat has become one of the main concerns in terms of cyber security, affecting both individuals and businesses.
Ransomware is usually spread via malicious email attachments or compromised websites. Once activated, the software encrypts the user's files, making access impossible without the appropriate key.
π Types of ransomware
There are several types of ransomware, including :
- Crypto-ransomware encrypts files and demands a ransom for the decryption key.
- Locker ransomware encryption: blocks access to the computer without encrypting the files.
- Double extortion ransomware encrypts and steals data, threatening to publish it if the ransom is not paid
Examples of ransomware
The best-known ransomwares include :
- CryptoLocker one of the first to demand a bitcoin ransom.
- WannaCry Windows: exploited a Windows vulnerability to infect more than 300,000 computers in 150 countries.
- Petya/NotPetya The "SARS" virus: blocks access to the entire system and has caused major disruptions in several companies around the world
π₯ Consequences of ransomware
The repercussions of a ransomware attack can be serious and varied.
Financial impact
- Financial loss ransomware: companies often have to pay a ransom to recover their data, with amounts ranging from a few hundred to several million euros.
- Cost of remediation costs associated with restoring systems and bringing in cyber security experts can mount up quickly
Interruption of activities
- Operational paralysis Access to systems and data is blocked, which can lead to business downtime for hours, days or even weeks..
Impact on reputation
- Loss of confidence loss of confidence: customers and partners may lose confidence in the company, damaging its reputation and possibly leading to a loss of customers.
Legal risks
- Potential lawsuits If personal data is compromised, the company may face legal action and fines for non-compliance with data protection regulations (RGPD, etc.).
How ransomware works
The main stages:
- Infection the ransomware penetrates the system, often via an e-mail from phishinga vulnerability or unsecured remote access (e.g. RDP).
- Propagation It spreads throughout the network to maximise its impact.
- Encryption The malware encrypts important files, making them inaccessible.
- Ransom demand The attacker demands payment to provide the decryption key.
π Statistics on ransomware
π«π· In France
- Prevalence of attacks In 2024, France recorded a high rate of ransomware attacks, with 86 % of IT decision-makers reporting that their company had been the victim of an attack, compared with 53 % in 2023.. This makes France one of the most targeted countries in the world.
- Ransom payments Despite non-payment policies, 92 % of French companies affected by ransomware admitted having paid a ransom to recover their data, at an average cost of 653,000 euros.
- Active groups The Lockbit group has been particularly active in France, claiming 13 attacks in the second quarter of 2024.. Other groups such as BlackCat and 8Base were also present, but to a lesser extent.
- Sector impact SMEs are particularly hard hit, accounting for 60 % of attacks. The financial, banking and government sectors are frequently targeted, particularly hospitals that host sensitive health data..
π Worldwide
- Volume of attacks In 2023, there was a significant increase in ransomware attacks, reaching a total of 5,070 incidents, an increase of more than 55 % compared with the previous year..
- Countries most affected The United States remains the most targeted country, accounting for around 49.8 % of all global attacks in 2023. The UK and Canada follow in the overall ranking.
- Cost of recovery Ransomware: on a global scale, the average cost of recovering from a ransomware attack reached around $2.73 million in 2024.
- Dominant cybercriminal groups : LockBit remained the most active ransomware group in 2023, with around 1,047 successful attacks. Other notable groups include ALPHV and Cl0p.
Sources: Norton Security, Trend Micro, Clusif, Cisco Talos
