
In 2020 and 2021 BlackFog measured publicly disclosed attacks globally. The 2021 ransomware attack report summarizes these findings and highlights the key trends as we enter 2022.
In 2021 there were a record total of 292 reported ransomware attacks, representing an increase of 17% year over year. Of these attacks more than 80% involved data exfiltration in some form with records disclosed on the Dark Web, websites and directly to the victims. Of those, 1 out of 3 utilized Botnets and 2/3 illegal networks. We also saw 80% of ransomware utilize PowerShell to infect victims.

Geographically the United States continue to dominate these attacks with over 51%, followed by the UK with 10%, Canada 5% and France and Australia 3%. The top 3 countries represented 2 out of every 3 attacks. In addition, 1 out of every 3 attacks exfiltrated data to China or Russia (16% and 12% respectively).

At an organizational level we saw a continued trend to focus on small to medium enterprises in the last 4 months of the year, with the average size organization of 8,300 employees. In 2021 we also saw the average size of the target organization decrease by 31% to an average of 15,581 employees compared to 2020.
In 2021 we saw the biggest increase in ransomware in the retail sector with 100% growth. This was followed by an 89% increase in technology, 30% increase in healthcare, and 24% increase in government over 2020 numbers.

Ransomware continues to see new variants and 2021 was no exception. With the success of the Colonial Pipeline attack we saw REvil dominate the landscape early and finish the year with the highest number of victims, representing 17.5% of all attacks. The latter half of the year saw a massive increase in the number of attacks from Conti, which finished the year at 16.8% of all variants, and an increase of 228% over 2020. On the positive side we saw the virtual elimination of some variants such as Ryuk, Maze Nefilim and a 160% decrease in DoppelPaymer.

BlackFog has also made a number of predictions for 2022 so we shall see how these play out through the year. We are also seeing a continued increase in publicized attacks only a couple of weeks into the new year.
Related Posts
BlackFog report reveals 63% increase in Q2 ransomware attacks YoY
BlackFog report reveals 63% YoY surge in ransomware attacks in Q2 2025, with healthcare and retail sectors among the hardest hit.
Fog Ransomware Surges in 2025 Hitting Schools and Banks Alike
Fog ransomware has surged in 2025, targeting the educational and financial sector. Learn about its technical tactics, double extortion methods, and defense strategies.
Data Risk Assessment: The First Step Toward Smarter Data Protection
Understanding how to conduct a data risk assessment is a key step in protecting systems and networks from both internal and external threats.
Data Risk Management: A Smarter, Deeper Approach
Make sure your data risk management strategy goes beyond the basics to ensure critical information is safe from hackers, accidental breaches and other threats.
GDPR Audit: A Practical Guide to Staying Compliant
What should firms be thinking about when conducting a GDPR audit and why must this be a key part of a data risk management strategy?
5 Emerging Data Security Threats You May Not Have Considered
Keep an eye on these five rapidly-evolving data security threats to ensure sensitive information is fully protected from exposure.