Report: The cost of ransomware in 2020. A country-by-country analysis

In The State of Ransomware in the US: Report and Statistics 2019, we examined the number of ransomware attacks on the U.S. public sector and the cost of those attacks. In this report, we will examine the number of attacks on both the public and private sectors for a number of countries and estimate the cost, including the cost of downtime, of those attacks on a country-by-country basis as well as estimate the overall global costs.

The calculation method and assumptions

• The number of incidents is derived from submissions to ransomware identification service ID Ransomware. Every submission to this service represents a confirmed incident, and there was a total of 452,151 submissions during 2019. 
• Approximately one-half of all submissions to ID Ransomware relate to a type of ransomware called STOP which has a below-average ransom demand and mainly affects home users. We shall, therefore, be reducing the submission numbers by 50% for the purpose of our calculations (the number stated in the tables is the actual number of submissions, but the calculations are based on half that number).
• We believe that only approximately 25% of public and private sector organizations affected by ransomware use ID Ransomware and so shall be providing two cost estimates: a minimum cost based on 50% of the actual number of submissions and an estimated cost based on that reduced number x4.
• The average ransom demand is $84,000¹. Note, however, that while we have based our calculations on $84,000, recent evidence suggests that this amount may have increased significantly in recent weeks.
• 33% of companies pay the ransom demand².
• Ransomware incidents result in an average of 16 days downtime¹.
• We were unable to find a reliable estimate for downtime costs across all sectors and sizes of businesses – Gartner previously put the average at more than $5,600 per minute – so we have used the extremely conservative figure of $10,000 per day. This figure has no basis in reality and we have included it simply to illustrate the enormity of the costs. The actual costs are almost certainly much higher. As downtime is experienced whether or not a ransom is paid, the minimum cost is based on 50% of the submissions to ID Ransomware while the estimated cost is based on that reduced number x4. As above, we have reduced the numbers by 50% to exclude STOP from the calculations.

Country-by-country breakdown

Ransom demand costs

Total cost: ransom demand costs +  downtime costs (16 days)

Conclusion

The data in this report is partly derived from third party statistics which may be based on limited datasets and, consequently, the costs stated above may be significant over- or underestimates. The calculations are, however, based on the best information currently available and we have almost certainly significantly understated the cost of both ransom demands and downtime.

While the above costs may seem extraordinarily high, it should be remembered that ransomware incidents can be exceptionally expensive – for example, Norsk Hydro estimated its ransomware-related losses at more than $50 million,

The intention of this report is not to accurately estimate the costs, which is impossible due to a dearth of data, but rather to shine a light on the massive economic impact of these incidents in the hope that doing so will help governments and law enforcement agencies formulate a proportionate response to the ransomware crisis.

Sources

¹ Ransomware Costs Double in Q4 as Ryuk, Sodinokibi Proliferate – Coveware

²2020 State of the Phish Report – Proofpoint