Which industries are hit hardest by ransomware?
Well, that depends on what you mean by "hit hardest." Do you mean which industries most often suffer ransomware attacks/incidents? Or which ones are the most impacted financially?
Regardless of which dimension is top of mind for you, I have good news: this chart from the Cyentia Institute's latest edition of the Information Risk Insights Study (sponsored by CISA) offers a view of both. It plots each sector according to the share of incidents and publicly-known losses over the last five years attributed to ransomware.
If frequency and losses were perfectly correlated, sectors would lie on or near the dashed line. In general, that’s not the pattern we see here. Instead, we see industries that are disproportionately impacted by ransomware relative to event frequency (e.g., Healthcare, Hospitality), while the opposite is true for others (e.g., Financial, Professional). A myriad of factors contribute to the placement of sectors in Figure 14, but the targeting strategy of ransomware gangs is likely a major driver among them.
So, back to the original question - does this sync with your expectations on ransomware-ravaged industries?
Link to download the study (no registration required): https://www.cyentia.com/iris-ransomware/