Dive Brief:

• The number of ransomware attacks hitting U.S. and international organizations continues to climb, despite an extensive and growing effort to reduce the volume and impact of these attacks, U.S. cyber authorities said Sunday.
• Ransomware attacks increased 74% from 2,593 global attacks in 2022 to 4,506 attacks in 2023, officials said during a briefing before the fourth annual International Counter Ransomware Initiative summit. This year is already on track to exceed 2023’s record. “In the first half of 2024, we’re tracking 2,321 attacks,” said Laura Galante, director of the Cyber Threat Intelligence Integration Center at the Office of the Director of National Intelligence.
• About half of all ransomware attacks hit U.S. organizations during the first half of 2024, Galante said. Healthcare and emergency services were among the most heavily impacted sectors during that period, Galante said.

Dive Insight:

Federal authorities shared the increasing attack trend as cyber officials representing 66 countries, including 18 new members of the initiative, the EU and Interpol, gathered in Washington this week to advance global efforts to fight ransomware activity.

“The incentives to continue ransomware attacks remain, largely because entities pay ransoms,” Anne Neuberger, deputy national security advisor for cyber and emerging technologies, said in the pre-summit briefing.

It’s been a “difficult lesson,” Neuberger said.

This year’s ransomware attacks on Change Healthcare, which paid a $22 million ransom demand, and car dealership software vendor CDK Global, which impacted 100,000 car dealership sales during the recovery period, underscore ransomware’s broad impact on companies, the economy and critical infrastructure at large, Neuberger said.

At the summit this week, CRI members will build upon last year’s joint policy statement discouraging institutions under their national government authority to pay ransomware extortion demands. The international policy endorsement will include guidance from global cyber insurance bodies to help organizations build resilience to cyberattacks and reduce disruption costs.

“We've seen progress in improving resilience,” Neuberger said. “But still, too many entities are paying ransoms, and each payment incentivizes the next attack.”

Members will also consider a joint statement calling for countries to be held accountable in denying ransomware operators a safe haven. This effort highlights the geopolitical challenge of combating ransomware, as the majority of ransomware operators are based in Russia, and “Russia hasn’t asked to join” the CRI, Neuberger said.