Ransomware has been around since 1989, when Harvard-trained biologist Joseph L. Popp built the first version—what’s known today as the AIDS Trojan, or PC Cyborg. More than three decades later, it’s the top security threat facing banks and credit unions, and it isn’t slowing down. Ransomware locks people out of their own devices or files until a ransom gets paid, or some other demand gets met. What follows can include days of downtime, lost data, stolen intellectual property, and costs that stretch well past the ransom itself. Institutions that put mitigation tactics in place before an attack are the ones positioned to recover from one. For banks that don’t have deep technical bench strength in-house, working with a third-party partner is how that gap gets closed, bringing in the training, tools, and expertise built for hardening a financial institution’s defenses.

Ransomware’s Insidious Nature and Impact

Ransomware is built to do damage. Most infections start with a social engineering attack: a phishing link or an attachment that looks legitimate enough to open. Once someone clicks, the malware installs itself and starts encrypting every file it can reach, on the machine and across any shared networks and devices. Sometimes that encryption is a distraction. While an institution scrambles to respond, attackers are quietly pulling sensitive data out the back door, data they can sell, use for a second round of ransom demands, or hold over the institution for extortion.

The damage from a single infection compounds: lost data, business interruption costs, legal bills. Financial institutions and other critical-infrastructure organizations that get hit can also face fines or added regulatory scrutiny for failing to protect customers’ non-public information. And regardless of industry, a successful breach costs something no insurance payout covers cleanly: the trust and reputation an institution spent years building.

Current Ransomware Trends

Proliferation of Attacks

There are a lot of forces behind ransomware’s growth, and the growth itself is hard to overstate. Ransomware attacks rose almost 13 percent last year, an increase as large as the previous five years combined, according to Verizon’s 2022 Data Breach Investigations Report. The FBI’s Internet Crime Complaint Center logged 3,729 ransomware complaints in 2021, with adjusted losses topping $49.2 million.

The problem isn’t confined to any one sector. About 37 percent of organizations worldwide were hit by a ransomware attack in 2021, per the International Data Corporation’s 2021 Ransomware Study. Most of the country’s critical infrastructure has already been targeted: in February 2022, the Cybersecurity and Infrastructure Security Agency reported that 14 of 16 U.S. critical infrastructure sectors, including financial services, had experienced ransomware incidents.

Cost and frequency are moving in different directions. IBM’s 2022 Cost of a Data Breach Report found the average cost of a ransomware breach, not counting the ransom itself, dipped slightly, from $4.62 million to $4.54 million. But frequency climbed, from 7.8 percent of breaches in 2021 to 11 percent in 2022.

Evolving Types and Tactics

Ransomware isn’t just growing. It’s changing shape. Attackers are building new malware variants, layering more dimensions into each attack, and getting better at evading detection. Because banking is critical infrastructure, those shifts carry more weight here than elsewhere.

Depositors have a backstop: FDIC insurance covers bank deposits up to $250,000 at participating institutions, so consumers can generally recover their money after a breach. Banks themselves don’t have that same protection. A major ransomware attack can threaten an institution’s solvency, and enough bank failures at once can put pressure on the stability of the financial system itself.

The malware landscape keeps splintering. VirusTotal’s Ransomware in a Global Context report counted more than 130 distinct ransomware strains since 2020. REvil and Ryuk were the two most active in 2021. REvil alone accounted for 37 percent of the ransomware incidents IBM’s X-Force team remediated that year, more than a third of everything they saw, with Ryuk a distant second at 13 percent.

The variant count keeps climbing too. FortiGuard Labs tracked 10,666 ransomware variants in one six-month stretch, compared to 5,400 in the period before it: nearly double in half a year.

Attackers are also getting more selective. Instead of blasting out high-volume attacks, many are shifting toward customized attacks aimed at specific targets likely to pay more, faster. The ransom demand itself has changed shape too. IBM’s X-Force Threat Intelligence Index found that nearly all ransomware attacks today are “double extortion” attacks, demanding payment both to unlock data and to keep stolen data from being released.

Ransomware gangs behave less like fixed organizations and more like brands that reinvent themselves. GandCrab became REvil. Maze became Egregor. DoppelPaymer became Grief. X-Force’s research puts the average gang lifespan at 17 months before a rebrand or a shutdown. REvil, one of the more successful groups, lasted 31 months before closing up shop in October 2021.

Phishing and vulnerability exploitation remained the top two ways ransomware got in during 2021, according to X-Force. The Log4j vulnerability, CVE-2021-44228, is one well-known example that got exploited this way. A smaller share of intrusions came through stolen credentials, brute force, remote desktop protocol, and removable media. FortiGuard Labs also flagged a specific target of the remote-work era: work-from-anywhere endpoints, which give attackers a new way into corporate networks.

Some of the most damaging recent attacks haven’t stopped at the organization that got breached. REvil was the alleged actor behind attacks on IT hardware vendor Acer in March 2021, meat processor JBS USA in June 2021, and remote management software vendor Kaseya in July 2021. Each one rippled out to the vendor’s own customers and partners.

Schools, health systems, and local governments got hit too, in early 2022 alone: Pembroke Pines, Florida, on January 13; Linn County, Oregon, on January 24; and New Bedford, Massachusetts, on January 27. Ransomware’s profitability and reach mean supply chain attacks like these aren’t going away soon.

What Is Driving Ransomware Growth?

Monetization

Money is the reason ransomware keeps growing. Attackers can pull multi-million-dollar payouts from a single major attack, and meaningful sums even from smaller ones. In 2021, one in ten organizations worldwide paid $1 million or more in ransom, according to Sophos’s State of Ransomware 2022 report. The highest average payments landed in manufacturing, at $2.04 million, and energy and utilities, at $2.03 million. The findings come from a survey of 5,600 IT professionals at mid-sized organizations across 31 countries, conducted by research agency Vanson Bourne.

Increased Accessibility of Ransomware Software

Attackers keep getting more sophisticated, but launching an attack has never required less skill. Ransomware-as-a-service has turned malware into a subscription product, and that’s opened the door to a much wider set of would-be hackers. Someone with no technical background can buy a malware package on the dark web and put it to use the same day.

An underground economy has grown up around this model, with service providers supplying tools, expertise, or full execution of an attack from start to finish. Some ask only for a cut of the ransom payment, which lets them profit from a wide range of targets with almost no risk of their own. Others aren’t even after money directly: the “Dot” and “Philadelphia” strains offered victims their files back for free if they infected two other organizations. And because financial institutions are high-profile targets, some attackers go after banks purely for the notoriety. Between the growth of ransomware-as-a-service and the providers built around it, ransomware is now a constant threat to every institution and every device.

Closing Security Gaps

Closing every known security gap takes systems, processes, and discipline. Security itself is part science, part instinct. The science is a strategy that pulls together the right mix of technologies, backed by the knowledge to apply them well. The instinct is thinking like an attacker, weighing the hundreds of variables that go into a policy that actually holds up.

With ransomware, an ounce of prevention is worth a pound of cure. Any gap in a system is one hackers will eventually find. Something as simple as talking about security regularly, and getting people in the habit of questioning what looks off, goes a long way toward heading off a costly incident.

People are the weakest link in the equation. Human error is behind most ransomware breaches: hardcoded passwords, admin credentials still set to their factory default, systems that don’t get patched, networks that aren’t segmented from each other, and a habit of not questioning things that feel off.

The real key is a cyber security policy that’s actually followed, not just written down. The principle of least access is a good example: give people only the level of access they need to do their job, nothing more. Network design matters too. Segmenting a network means malware that gets in stays contained to one part of it instead of spreading across everything. Think of a castle built with a moat, an outer wall, and several gates, instead of a warehouse with a single door anyone can walk through once they’re in.

Layering security products and services gives an institution more than one line of defense. For institutions that don’t have deep technical expertise in-house, an experienced managed service provider can fill that gap. What doesn’t transfer is oversight. An institution can hand off the work, but not the responsibility for it. That means choosing an MSP carefully, and holding them to the same security standards the institution holds itself to.

Preventing and Recovering From an Attack

Prevention

Financial institutions are a growing target, in part because of what they store: customer account numbers, credit card numbers, Social Security numbers. The best policy is stopping an attack before it starts. That work is slow and repetitive, day after day of the same checks and the same habits. Done consistently, it’s also what actually works.

Training staff well is one of the most important steps an institution can take, since most ransomware intrusions trace back to a human mistake: someone doing something they shouldn’t, or not doing something they should. Layering security products and services matters here too. If one layer fails, another one is there to catch what got through.

Recovery

Even the most hardened system can only do so much. Once an intrusion happens, the goal shifts to limiting the damage as fast as possible, which means having the systems and processes in place before an attack, not during one.

Recovery runs through processes that already exist before an incident does, for incident response, vendor management, and business continuity alike. Under FFIEC guidance, management should maintain an incident response program built to minimize damage to the institution and its customers, with defined protocols for declaring and responding to an incident. That program should cover containing the incident, coordinating with law enforcement and other parties, restoring systems, preserving data and evidence, supporting affected customers, and getting the institution back to normal operations.

Having those protocols defined ahead of time is often what separates institutions that contain an attack from ones that don’t. Containment strategies vary by institution, but the work after an incident usually comes down to the same handful of things: isolating compromised systems or watching intruder activity closely, searching for other systems that may have been hit, preserving evidence, and communicating with affected parties, often including the primary regulator, information-sharing organizations, or law enforcement.

Restoration means two things at once: cutting off however the intruder got in, and getting systems, programs, and data back to a known good state. That’s where offline or offsite backups earn their keep. A backup that’s still connected to the network can get encrypted right along with everything else. From there, institutions need to notify and support affected customers in line with applicable laws and regulations, and keep watching for signs of a repeat incident.

Cyber insurance is worth a call, if it applies. It isn’t a fix-all, though. Carriers have been adding exclusions that let them deny ransomware claims, and an insured company is usually held responsible for whatever let the intrusion happen in the first place. Fewer carriers are offering this coverage at all now, given how costly claims have gotten to settle. Even when a claim is paid, a settlement rarely covers the full cost: the reputational damage, the stolen intellectual property, the revenue lost once a breach becomes public.