Trustwave: ransomware attacks have quadrupled YoY in 2019 and have overtaken credit card theft as the most common form of cybercrime
Danny Palmer / ZDNet :
Context & Ripple Effects
Trustwave's finding caps a four-year escalation the coverage has tracked step by step: ransomware had already quadrupled once before in 2016, when Trend Micro sized the market at $1B in annual criminal revenue, and FireEye later found 76% of enterprise attacks now land outside business hours to hit understaffed IT teams. What changes with this report is the ranking itself — extortion has displaced credit card theft as cybercrime's default business model, meaning attackers increasingly monetize disruption rather than stolen payment data.
The corporate side was already adapting: ransomware appeared in over a thousand SEC risk-factor filings in the year after this report, up from 749 in 2018, signaling that boards and auditors treat it as a standing operational risk rather than an anomaly.
First-order effects
- Security buyers' priorities shift immediately: defenses tuned to stop data exfiltration and card fraud are mismatched against attackers whose goal is encrypting networks for ransom, pushing spending toward backup resilience and incident response.
- Trustwave's ranking gives CISOs and insurers a benchmark for threat briefings, replacing card-theft assumptions that shaped compliance budgets through the card-data era.
Second-order effects
- Cyber insurers absorb the shock directly — by H1 2020 ransomware already drove 41% of cyber insurance claims with average demands up 47%, forcing carriers to reprice policies and scrutinize clients' backup hygiene before underwriting.
- Disclosure pressure compounds: with ransomware named in 1,000+ SEC filings in a single year, companies face investor and auditor expectations to document ransomware readiness, feeding demand for managed detection and response services.
Third-order effects
- If the pattern holds, cybercrime consolidates around an extortion economy — leak-site shaming of victim organizations, already visible in the Q2 2021 wave hitting 740 organizations, becomes the enforcement mechanism that makes ransoms harder to ignore.
- The shift from stealing payment data to extorting operations restructures the industry around availability risk, pulling regulators, insurers, and disclosure rules into policing ransomware as systemic infrastructure risk rather than individual loss events.
The trend: Cybercrime is migrating from monetizing stolen payment data to extorting whole organizations, with each annual report since 2016 confirming ransomware's climb to the top of the threat rankings.