Ransomware statistics for 2021: Q4 report

Ransomware statistics for 2021: Q4 report

Over the course of 2021, we’ve seen an unprecedented level of legal action taken against ransomware actors – a trend that continued into Q4.  

In late October, Europol announced the arrest of 12 individuals suspected to be affiliated with the LockerGoga, MegaCortex and Dharma ransomware operations. Also in October, prolific ransomware group REvil was forced to cease activity after its servers were compromised during a successful U.S. Cyber Command operation. Then, in November, the FBI arrested a Ukrainian national and REvil affiliate allegedly responsible for the devastating ransomware attack on American software company Kaseya in July 2021; and a Russian national, who was charged with conducting REvil ransomware attacks on multiple targets in Texas in August 2019. 


Q4 marked more anti-ransomware initiatives from the White House, including the signing of the Enhancing K-12 Cybersecurity Act, which aims to promote access to information, better track cyberattacks nationally and provide school districts with more cybersecurity resources. The White House also hosted a two-day virtual ransomware summit with government representatives of 30 nations in attendance. Following the summit, the participating countries released a joint statement recognizing “the need for urgent action, common priorities, and complementary efforts to reduce the risk of ransomware.”  


But it wasn’t all good news. The healthcare sector was involved in a number of high-profile incidents in Q4, including an attack on the Los Angeles branch of Planned Parenthood in which the personal information of approximately 400,000 patients was compromised. A couple of weeks later, an attack on the healthcare systems of Newfoundland and Labrador, Canada, resulted in threat actors gaining access to 14 years’ worth of patient and employee information.  


The following statistics are based on data from 149,308 submissions to Emsisoft and ID Ransomware, a service that enables victims to identify which ransomware strain has encrypted their fil ..

Support the originator by clicking the read the rest link below.