SoylentNews

Backups "No Longer Effective" for Stopping Ransomware Attacks

posted by martyb on Saturday February 26 2022, @03:16PM   

upstart writes:

Backups 'no longer effective' for stopping ransomware attacks:

The growth of double extortion – and even triple extortion – ransomware attacks is in danger of rendering common, traditional methods of mitigating the impact of a ransomware hit, such as well-maintained backups, less efficacious, according to a report from machine identity specialist Venafi.

Data collated from Venafi's worldwide survey of IT and security decision-makers reveal that 83% of successful ransomware attacks now involve alternative extortion methods – for example, using stolen data to extort customers (38%), leaking data to the dark web (35%), and informing customers that their data has been compromised (32%). A mere 17% of attacks merely ask for money for a decryption key.

Venafi said that this means that because ransomware attacks now rely on data exfiltration, effective backup strategies are therefore to some extent "no longer effective" for containing a breach.

"Ransomware attacks have become much more dangerous. They have evolved beyond basic security defences and business continuity techniques like next-gen antivirus and backups," said Kevin Bocek, vice-president of business development and threat intelligence at Venafi.

Venafi also found that cyber criminals are increasingly following through on their threats whether or not they get paid. Indeed, 18% of victims had their data leaked despite paying, while more than the 16% who refused outright to pay anything and had their data leaked. Some 8% refused outright, but then had their customers extorted; and 35% paid, but were left hanging, unable to retrieve their data.

---

Original Submission

• Re:If you want to keep your data off the Internet Re:If you want to keep your data off the Internet (Score: 1, Insightful) by Anonymous Coward on Saturday February 26 2022, @07:01PM (1 child)

  by Anonymous Coward on Saturday February 26 2022, @07:01PM (#1225146)

  Indeed, online shops should only store their customer's credit card info offline.

  How about NOT STORING IT AT ALL?
  The ONLY place on the damn Internet that has ANY business storing my credit card info, is the bank that issued the card. Any other outfit that keeps the data past the transaction, is doing it for the sole reason of scamming me.
  Not that in my case the data they squirrel away would help them, or any other crooks, any: https://en.wikipedia.org/wiki/3-D_Secure [wikipedia.org]

  Parent

  Starting Score:	0		points
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Total Score:		1

• Re:If you want to keep your data off the Internet (Score: 0) by Anonymous Coward on Saturday February 26 2022, @07:21PM

  by Anonymous Coward on Saturday February 26 2022, @07:21PM (#1225150)

  You should be aware then that 3-D Secure can be skipped by the payment processor, for example Amazon Payment Services (https://paymentservices.amazon.com/docs/EN/54.html):
  >It is also possible to bypass the 3D Secure authentication process based on a set of rules that you define in the back office.

  Parent