An explanation of how the threat of ransomware attacks on organisations has developed throughout 2024, drawing on data from the Sophos State of Ransomware survey and explaining how Intercept X can offer advanced defences against this prevalent threat.

Ransomware is a type of malicious software that, if installed, can stop you from gaining access to your systems and will then demand that you pay the perpetrator to regain access – in other words, it will hold your systems to ransom. Ransomware can come in many shapes and sizes, below are a few of the most common types that we outlined in 2023. Want to find out how to protect your company? Skip down to Protective Actions.

Ransomware can have an enormous impact on your company's operations and data security, and some organisations take up to one month to recover from an attack. Here are some key takeaways about the impact of ransomware from the Sophos State of Ransomware update in 2024.

Ransomware continues to be the most impactful cybersecurity threat, with its high financial rewards and established business model making it an attractive extortion method. Criminals target a wide range of organisations, many of which don’t make the headlines, but those who do have historically been those with the highest reward potential.

For example, threat actors have attacked hospitals, schools, and government entities across the world, with local councils and the National Health Service (NHS) being some of the most public cases in the UK. Infrastructure companies such as these typically have outdated and unsupported legacy systems, and therefore are an easy target for threat actors looking to exploit vulnerabilities and enter their network. 

Ransomware-as-a-Service (RaaS) is an increasingly popular platform that criminals and threat actors can use to access ransomware with no upfront costs. Many platforms operate with a subscription model, which mirrors the successful models used by legitimate platforms, to offer access to ransomware variants, distribution channels, and support in exchange for a share of the profits.

Hackers can leverage RaaS platforms to perform the most efficient and effective assaults on any chosen company, with this increased accessibility to powerful malware products making the ransomware extortion method as the most profitable cyberattack on the market today. As these platforms continue to develop into 2025, there will be a significant increase in the threat of cybercrime on organisations.

Artificial Intelligence (AI) is expected to have an enormous impact on the threat of ransomware. Criminals are already using AI to streamline cyberattacks, and it will almost certainly increase the volume and impact of attacks in the near future. It enables relatively unskilled threat actors to carry out sophisticated attacks, with improved targeting and more effective information-gathering than ever before.

There are reports that AI is helping criminals to develop malware that can avoid detection by security software, craft phishing emails that are extremely targeted and persuasive, and encrypt files at a startling rate. As this continues, it could have an unprecedented impact on businesses across the world, which is why it’s so important to take a proactive approach to your cybersecurity.

Across the UK there has been an increasing number of attacks on local government organisations and public service companies. Recently, for example, we saw Synnovis, an NHS pathology services provider, experienced an attack that caused the cancellation of over 10,000 appointments and a significant data leak that immediately made the headlines. The extent of the attack meant that they had to rebuild their IT systems to continue to operate, which caused significant disruption to their operations.

In 2023, we saw Gloucester City Council fall victim to a ransomware attack for the second time in 10 years, where many of the council’s systems were encrypted and taken offline. It cost the council £1.1 million to remediate the damage caused by this attack. Hackers, in these instances, appear to be targeting large public organisations to perform extortion at the threat of an enormous data leak. Any company with a significant amount of public data should be concerned about the increasing threat of a ransomware attack.

Transportation has been brought back into the spotlight recently with the incident that occurred with Network Rail’s WiFi network this September. Attackers were able to use a vulnerability in their network and transmit extremist messages onto the devices of unaware service users, which caused considerable concern amongst the public and made headlines. In 2023, KNP Logistics Group was attacked by threat actors who caused irreparable damage to their systems in an incident that plunged the company into insolvency, making 730 people redundant. 

In these examples, the motivations of the threat actors appear to be mixed. In the Network Rail incident, it appears to be a case of ‘Hacktivism’, where the threat actors were politically motivated and were sending a message to service users. However, in the case of KNP Logistics, we can estimate that ransomware was used purely to extort the company. Similar transport organisations should be concerned about the latter example, as it highlights that cybercriminals do target private organisations more frequently than what we’re aware of, as many instances don’t make the headlines.

In recent years, the manufacturing industry became a prevalent target for security attacks due to legacy systems and unpatched applications. One of the more notable examples is Wiltshire Farm Foods who provide frozen ready meals to care homes, nurseries, hospitals, and schools in the South West. In 2022, they were attacked by threat actors who were able to significantly disrupt their operations and leave service users without meals.

Attackers were able to cause enough damage to mean that the company had to rebuild and replace most of their hardware and software, likely costing hundreds of thousands of pounds. In response to the increased threat of ransomware, we have seen companies like Castell Howell and AG Barr onboard with Sophos Intercept X to manage their cybersecurity.

If you think that your business could benefit from Intercept X, or if you'd like to find out more information about how we can improve your cyber defences, please book a free discovery call with one of our experts below. We'll be happy to help, in whatever way we can.