Flashpoint observes 84% surge in ransomware attacks in 2023

Data breaches surge

Ransomware attacks were a major contributor to the 34.5% jump in data breaches in 2023. Operators increasingly leveraged brazen data extortion threats to pressure payments from victim organizations. The manufacturing and technology industries felt the brunt of it; Flashpoint analysts discovered that ransomware and unauthorized access accounted for more than 85% of all publicly disclosed breaches for organizations in those sectors. One prime example was Western Digital, which disclosed an attack in April.

Overall, Flashpoint analysts recorded 6,077 global data breaches in 2023 that leaked more than 17 billion personal records, and U.S. organizations accounted for the majority.

However, Flashpoint found that many incidents stemmed from attackers gaining unauthorized access to third parties. One prime example was the extensive threat campaign against customers of Progress Software's MoveIt Transfer product. While there was no actual ransomware deployment, the Clop ransomware group exploited a zero-day vulnerability in MoveIt Transfer that subsequently affected thousands of organizations.

"Flashpoint analysts determined that the MOVEit attack was responsible for 19.3% of all reported 2023 data breaches. This figure includes affected third-parties, organizations who were not directly compromised by Cl0p, but had sensitive data stolen from vendors within their supply chain," the report said.

The problem has worsened in 2024. The report emphasized that the amount of stolen data from Jan. 1 to Feb. 29 increased by 429% compared with the same period last year. Ransomware attacks and unauthorized access continue to be the primary culprits.

Ian Gray, vice president of cyberthreat operations at Flashpoint, told TechTarget Editorial that misconfigurations and unintentional data loss also contributed to the year-over-year rise in data breaches, which includes accidentally leaving containers and storage buckets exposed to the public internet. To prevent such incidents, he urged enterprises to check their access points and secure APIs.

Regarding ransomware, Gray said he believes the already staggering numbers would be higher if undisclosed attacks were included. He emphasized that the ransomware as a service (RaaS) ecosystem incentivizes enterprises to pay by threatening to publicly leak stolen data and causing prolonged disruptions to business operations. Enterprises often weigh the consequences of daily losses with ransom demand amounts.

He urged companies to verify whether ransomware actors are bluffing in regard to their stolen data claims. Flashpoint observed several instances of false claims from the RansomedVC ransomware group in 2023, for example.

"They're incentivizing companies to pay through as many measures as possible by giving them a way not to disclose incidents," Gray said.

Flashpoint, like other vendors, found that the LockBit ransomware gang was by far the most active in 2023 with 1,049 victims, followed by the Alphv/BlackCat ransomware gang with 459.

Despite an international law enforcement action dubbed "Operation Cronos" that temporarily disrupted LockBit last month, the group remains strong in 2024. Vendors attributed recent attacks on ConnectWise ScreenConnect customers to the gang, and Flashpoint tracked 154 victims on its public leak site within the first two months of 2024. The report emphasized that the number was "almost triple" compared with the second-most active groups, 8Base and Alphv/BlackCat.

Alphv/BlackCat was also temporarily disrupted by law enforcement last year. The takedowns have led to shifts in the RaaS ecosystem.

"We're also seeing something interesting with cross-posting of different victims," Gray said. "I've seen a minor instance of that last week or the week before where a victim appeared both in LockBit and BlackCat [leak sites]. BlackCat was taken down first, so we saw LockBit say, 'Hey affiliates, if you want to, come over here.'"

Although LockBit resumed operations following Operation Cronos, Gray remains optimistic about law enforcement actions and their effect on the threat landscape moving forward. During last month's announcement, the U.S. Department of Justice revealed how much cryptocurrency law enforcement agencies were able to seize from LockBit. Gray anticipates that agencies might now be able to trace the funds to identify ransomware operators across other RaaS groups.

"We're seeing this cat-and-mouse game, but I think we're seeing it tilt more toward law enforcement this time," he said. "I think things are definitely going to be getting better across the landscape. And I don't think there's a one-pill solution, obviously, but it's about working together, transparency, disclosure and understanding."

Arielle Waldman is a news writer for TechTarget Editorial covering enterprise security.