The 10 Largest Ransomware Attacks in the history
Over the last decade, several high-profile attacks have caused millions or even billions of dollars in losses, disrupted critical operations, and compromised sensitive information.
Ransomware has become one of the most dangerous threats facing businesses and governments today. Unlike traditional hacking, ransomware not only steals data but locks it completely, demanding a ransom to regain access. Over the last decade, several high-profile attacks have caused millions or even billions of dollars in losses, disrupted critical operations, and compromised sensitive information. Understanding these attacks can help businesses take preventive action before itís too late.
Unnamed Fortune 50 Company / 2024
In 2024, a Fortune 50 company faced one of the largest ransomware attacks on record. Attackers from the Dark Angels group stole hundreds of terabytes of sensitive corporate data and demanded a ransom of 75 million USD. This is currently the largest confirmed ransom payment ever made. The scale of this attack illustrates how even the most secure companies can be targeted by sophisticated cybercriminals.
CNA Financial / 2021
CNA Financial, a major U.S. insurance provider, fell victim to the Phoenix Locker ransomware gang. Lockout from core systems lasted several weeks, and the company ultimately paid 40 million USD to regain access. Beyond the ransom, operational disruption caused additional financial losses and highlighted the vulnerability of critical financial services.
Change Healthcare / 2024
Change Healthcare, part of UnitedHealth Group, suffered a ransomware attack that disrupted systems used by thousands of healthcare providers nationwide. While the estimated ransom was around 22 million USD, the total impact including operational downtime, recovery, and lost revenue was between 800 million to 2.5 billion USD. This attack shows the real-world costs of cyberattacks in essential sectors like healthcare.
Acer / 2021
In 2021, Taiwanese tech giant Acer was attacked by the REvil ransomware group. The attackers demanded 50 million USD for decryption tools and stolen data. Although Acer did not publicly confirm whether the ransom was paid, the attack demonstrated how technology companies can be lucrative targets for ransomware due to their valuable data assets.
NotPetya /2017
NotPetya is a notorious example of a destructive ransomware disguised as a conventional attack. It spread rapidly across global networks, affecting logistics firms, banks, and utilities. Financial damage reached an estimated 10 billion USD, making it one of the most costly cyberattacks in history. NotPetya was more of a wiper than a typical ransomware, showing that attacks can be both financially and operationally devastating even without ransom demands.
Ascension Healthcare System / 2024
Ascension, one of the largest healthcare systems in the U.S., faced a Black Basta ransomware attack that disrupted electronic health records and core operations. The financial toll, including recovery and operational loss, was estimated at 1.3 billion USD. This case emphasizes the critical importance of cybersecurity in healthcare, where data loss can directly affect patient care.
Kaseya VSA Supply Chain Attack / 2021
The REvil group exploited vulnerabilities in Kaseyaís remote management software, impacting over 1,500 downstream businesses. The attackers demanded 70 million USD for a universal decryptor. Many victims chose to rebuild systems rather than pay, demonstrating the cascading effect a single software vulnerability can have on hundreds of organizations.
Colonial Pipeline / 2021
The DarkSide ransomware gang targeted Colonial Pipeline, a major U.S. fuel supplier, causing widespread supply disruptions on the East Coast. The company paid 4.4 million USD in Bitcoin to restore operations, although part of the payment was later recovered by law enforcement. This incident highlighted how ransomware can affect critical infrastructure and the general public, not just businesses.
Caesars and MGM Casinos / 2023
Major U.S. casino chains, including Caesars and MGM Resorts, were targeted by ransomware attacks that disrupted operations and point-of-sale systems. The total financial impact exceeded 100 million USD. This example shows how ransomware can directly impact customer-facing services and revenue streams.
Costa Rican Government / 2022
In 2022, Costa Rican government agencies were attacked, forcing the country into a national emergency. While the ransom payment details are unclear, daily financial losses were estimated in the tens of millions, with recovery costs being enormous. This attack demonstrates that ransomware is not limited to private companiesóit can threaten entire governments and public services.
