Ransomware Attacks Surge in 2024 as Payments Drop, Signaling Tactical Shift Ransomware attacks reached unprecedented levels in 2024, with 5,243 victims documented on leak sites a 15% increase from 2023 while total ransom payments fell 35% year-over-year to $813 million, according to Travelers’ Q4 2024 Cyber Threat Report. The fourth quarter alone saw 1,663 attacks, the highest on record, exposing over 195 million records globally. Despite the rise in incidents, organizations appear to be resisting payment demands more frequently. However, the broader impact remains severe: 87.6% of attacks involved data theft, leading to costly disruptions, IT recovery efforts, litigation, and regulatory fines. ### Evolution of Ransomware Tactics Cybercriminals have shifted away from exploiting zero-day vulnerabilities, instead adopting methodical, repeatable attack methods. A leaked 2023 ransomware training manual revealed a focus on weak VPN and gateway credentials, particularly targeting accounts without multi-factor authentication (MFA). Attackers now proactively hunt for vulnerable systems using default usernames (e.g., admin, test) and common passwords, enabling large-scale targeting. ### Threat Actor Landscape Expands The ransomware ecosystem saw 55 new groups emerge in 2024, a 67% increase from the previous year. Nation-state actors are increasingly intertwining with criminal operations, bringing AI-driven capabilities such as advanced phishing and reconnaissance to ransomware campaigns. Notable groups in Q4 2024: - RansomHub led with 238 attacks (14% of the quarter’s total). - Akira and PLAY remained active with 133 and 95 attacks, respectively. - FunkSec, a newer group, drew attention for its AI-dependent attack methods, despite questions about its technical sophistication. ### Industry Targeting Patterns Certain sectors faced heightened threats: - IT services and consulting firms saw increased targeting. - Construction suffered 129 attacks in Q4, a 56% year-over-year rise. - Healthcare attacks climbed from 166 in 2023 to 210 in 2024. The report underscores a strategic shift in ransomware operations, with attackers prioritizing scalable, low-effort entry points over high-risk zero-day exploits. While financial losses from ransoms decline, the operational and reputational damage of these attacks continues to escalate.

The California Office of the Attorney General reported a data breach involving The Travelers Indemnity Company on December 10, 2021. The breach occurred between April 7, 2021, and November 17, 2021, when an unauthorized party accessed the agency portal, potentially compromising personal information including names and addresses of affected individuals. The exact number of individuals affected is unknown.