Veeam has compared regional data from recent Ransomware Trends Reports, exploring long-term ransomware and data resilience trends in EMEA.
The analysis revealed that the number of EMEA organizations paying ransoms dropped by nearly a quarter (22%) compared with the previous year. However, this doesn’t necessarily mean that organizations are facing fewer attacks. Instead, improvements in data resilience capabilities and shifting attitudes toward negotiating with attackers are emerging.
It’s clear from the reports that organizations are increasingly able to recover data without paying ransoms; in 2023, 14% recovered data without paying, while in 2024, this doubled to 30%. At the same time, there is growing recognition that paying ransoms does not guarantee data recovery; in 2023, more than half (54%) of EMEA organizations that paid were able to recover their data, but in 2024, this dropped significantly to just 32% – less than a third.
“As attackers remain an untrustworthy method of recovering data, and as organizations improve their data recovery capabilities, it’s no surprise we’re seeing a drop in the number of ransoms being paid. But this doesn’t mean the threat from ransomware is over,” said Tim Pfaelzer, Senior Vice President and General Manager, EMEA, Veeam. “Attackers will always adapt. We are seeing some forgo ransomware encryption entirely, instead stealing data to extort money directly or sell it on black markets. For some, financial gain isn’t even the main driver; disruption is. Payments may drop, but it doesn’t mean attacks will. And our data clearly shows that significant gaps remain in data resilience, leaving organizations vulnerable.”
Missing data resilience measures
In the wake of several EU regulations aimed at increasing organizations’ data resilience, such as NIS2 and DORA for financial services, organizations are taking steps to better prepare for ransomware attacks. But they can’t afford to stand still – there is still important work to be done.
In 2024, only 37% of EMEA organizations had arrangements for alternative infrastructure, meaning that two-thirds (63%) still lacked such plans. This means that, in the event of a site-wide attack, without alternative infrastructure these organizations will be unable to recover until the main site is declared clean, which in many cases could take multiple weeks. In any sector, a complete pause of operations for multiple weeks spells disaster, both reputationally and materially. With research suggesting that outages could cost over £1 million per hour of downtime, depending on the size of the company, these are costs few can afford to bear.
“It’s clear that organizations have put recovery at the heart of their data resilience strategy, rather than relying on paying ransoms, which is certainly a step in the right direction. But there’s more to be done,” added Tim Pfaelzer, SVP and General Manager, EMEA, Veeam. “Regulation may have brought data resilience levels up, but organizations need to take it one step further. They should focus on improving baseline data resilience with alternative infrastructure and robust backups to fully negate the need to ever pay ransoms. This way, they can drive lasting and effective improvements to their data resilience.”
Organizations’ standards around data resilience are steadily improving. Alongside this, law-enforcement crackdowns are disrupting ransomware attackers at their roots. However, there is still work to be done, and organizations need to prioritise implementing key data resilience measures such as alternative infrastructure and secure backups to reach true resilience. Otherwise, when the next attack hits, there might be no payment—but there will also be no route to recovery.
