Cyber extortion: What is it, and what’s the risk to your organisation?

Here’s a topic that’s been making headlines and causing sleepless nights for many: Cyber extortion.

Is it something that’s on your radar? It should be, because it might affect your organisation one day.

What is cyber extortion?

It’s a type of cyber crime where criminals threaten to harm your organisation by compromising its data and digital assets unless a ransom is paid. These threats often involve ransomware, a malicious software that encrypts your data, making it inaccessible until you pay the ransom.

Sometimes, cyber criminals go a step further by stealing data and threatening to release it publicly on dark web leak sites if their demands aren’t met. This dual threat is known as double extortion.

According to a 2024 report, the number of victims of cyber extortion scams has skyrocketed by 77% over the past year. What’s more, small organisations are four times more likely to be targeted compared to their larger counterparts. This is a worrying trend, especially considering that smaller organisations often have fewer resources to defend against these attacks.

In the first quarter of this year alone, 1,046 organisations fell victim to double extortion. That may not seem huge, but bear in mind that the actual number is likely much higher since many cases go unreported, hiding in the shadows of what experts call the “dark number.”

The truth is, all organisations, regardless of size or industry, are potential targets. However, certain sectors are more frequently attacked. Manufacturing, professional, scientific, and technical services, as well as wholesale trade, top the list. Alarmingly, the healthcare and social assistance sectors are also seeing a significant rise in attacks, despite the potential societal and political repercussions.

Cybercriminals are opportunistic and strategic. They target regions with strong economic growth and shared languages. For instance, cyber extortion attacks in the UK have increased by 96%.

While the rise in cyber extortion is a big worry, there are steps you can take to protect your organisation. Here are some key strategies:

• Back up your data: Make sure you have a robust backup plan. Keep your critical data in an offline or offsite location, and regularly test your backup restoration process.
• Keep software updated: Make sure all your devices use the latest software, especially those connected to the internet.
• Implement Multi-Factor Authentication (MFA): Strengthen your access controls with MFA. This adds an extra layer of security by requiring multiple forms of verification before access is granted (such as a code on a separate device). Also, limit user access to only the systems they need for their job.
• Patch and vulnerability management: Regularly update your systems to fix any security vulnerabilities. Cybercriminals often exploit known weaknesses, so staying on top of patches can prevent many attacks.

By understanding what cyber extortion is and how it works, you can better prepare your organisation to defend against it. Remember, the key is to be proactive.

If we can help prepare your school or business and keep it safe, get in touch.