Ransomware attacks have transitioned from a model of many small payments from various individuals to a smaller group of large targets with massive ransoms
2020 was a great year for ransomware gangs. For hospitals, schools, municipal governments, and everyone else, it's going to get worse before it gets better. Tweets: @salvodan , @iethics , and @andrewrdroste Tweets: Dan / @salvodan : @Techmeme @dougscripts @lilyhnewman Usually the same Large Targets over and over again. It's almost as if large companies can't adapt quickly to close the security holes. @iethics : “2020 was a great year for ransomware gangs. For hospitals, schools, municipal governments, and everyone else, it's going to get worse before it gets better”: https://www.wired.com/... #ethics #internet #cybersec #education #smartcities @andrewrdroste : “Everything that's played out this year leads me to believe it's going to just keep getting worse until something really dramatic happens. I anticipate seeing threat actors get more disruptive.” #CyberSecurity #ESG #CorpGov https://www.wired.com/... https://twitter.com/...
Context & Ripple Effects
This closes a loop that opened years earlier, when newly evolved crypto-ransomware turned every intrusion into a payday and attacks began hitting entire networks rather than single PCs — coverage that already flagged the move up from personal devices (crypto-ransomware built for network intrusions, attacks quadrupling while shifting to whole networks). Wired's year-end framing names the endpoint of that arc: big-game hunting, where hospitals, schools, and municipal governments replace thousands of individual victims.
First-order effects
- Hospitals, schools, and municipal governments now face ransom demands sized to organizational budgets rather than individual wallets, making each successful intrusion worth orders of magnitude more to attackers.
Second-order effects
- Consolidated targets mean concentrated fallout — the same large organizations get hit repeatedly because their security adaptation lags the payout size, as Dan observes in the article's tweet roundup.
Third-order effects
- Later payment data shows how volatile this model is: receipts fell from roughly $766M to ~$457M as victims increasingly refused to pay, then snapped back to a record $1.1B in 2023 ($1.1B in 2023 ransom payments), while gang budgets grew large enough that standard 'just patch' advice stopped being feasible guidance (multi-million dollar gang budgets outpacing basic advice) — pointing toward an arms race between institutional resilience and extortion economics rather than a simple decline.
The trend: Ransomware is consolidating into a big-game extortion industry whose revenue swings with victim willingness to pay, forcing large institutions — not consumers — to become the defensive frontline.