Rapid7 analysts have reported over 2,570 ransomware incidents in the initial six months of 2024. This averages out to roughly 14 publicly acknowledged attacks daily.
According to a Tuesday update from Rapid7, ransomware actors launched more than 2,570 attacks on businesses in the first half of 2024, equating to 14 attacks per day that were publicly recognized. There has been a notable increase in the number of ransomware groups exerting pressure on their targets. Specifically, the number of groups posting on data leak platforms surged by 67% in the six-month period ending in June. Rapid7 observed an average of 40 ransomware groups monthly engaging in these postings, a significant rise from 24 groups during the same period last year.
Additionally, the volume of posts on data leak sites increased to 2,611 by 68 ransomware groups in the first half of the year, marking a 23% rise compared to the previous year.
Insight:
The escalating frequency of ransomware attacks indicates that current industry and law enforcement measures are proving insufficient.
“Although there has been some impact from law enforcement actions—evidenced by a drop in LockBit’s activities in June—overall deterrents seem less compelling compared to the potential rewards,” Rapid7 noted in their report.
In February, a significant law enforcement action targeted LockBit’s ransomware infrastructure, leading to a temporary reduction in the group’s activities. However, this decline was soon offset by an increase in activity from other ransomware operators.
Throughout the first six months of 2024, the number of data leak site posts grew consistently compared to 2023. Each post signifies an attempt by ransomware criminals to extort organizations.
Rapid7’s data suggests a continuing upward trend, positioning 2024 to potentially exceed the previous year’s ransomware attack totals and data leak site postings. Last year, threat groups were responsible for 4,520 posts on data leak sites, reflecting a 75% increase from 2022, according to a June Mandiant report.
