Although 66 percent of respondents said the threat of ransomware is "very serious," only 13 percent reported that their company is prepared to prevent ransomware, according to a Carbonite report.
The report, conducted by The Ponemon Institute, surveys responses from IT professional and managers.
Here are five things to know.
1. Just over half of companies (51 percent) had experienced a ransomware attack, 48 percent of which paid the ransom. These companies paid an average of $2,500 per attack; however, only 55 percent of respondents said the cybercriminal decrypted the services or data after the payment was made.
2. Ransomware is most often deployed through phishing/social engineering (43 percent) or insecure websites (30 percent). The majority of respondents (58 percent) say negligent employees are a source of risk for ransomware attacks; only 29 percent are very confident employees can detect risky links and sites.
3. Following a ransomware attack, companies often invested in new security technology (33 percent), lost customers (32 percent) and lost money from lack of services during the ransomware incident (32 percent).
4. Almost half of respondents (49 percent) said their company did not report the ransomware attack, because they either did not want to publicize the incident (51 percent), did not feel the extortion was exorbitant (17 percent) or did not want the attackers to retaliate (10 percent).
5. Data backup can provide a shield against ransomware extortion. Of the respondents who were hit with a ransomware attack, but decided not to pay, 42 percent had a full backup; of respondents who had experienced a ransomware attack, 68 percent said it was "essential" or "very important" to have a full data backup.