TOKYO: The number of cases in which companies and other organizations reported ransomware damage to police has shot up, National Police Agency data showed Thursday.

The reported cases totaled 61 in 22 prefectures in the first half this year, against 23 cases over the three quarters through December last year. The agency started compiling data on ransomware cases in April last year.

In ransomware attacks, hackers encrypt data in the targets’ computers and demand ransoms from them to recover the data upon payment.

The agency believes that most of the attacks in January-June this year originated abroad. Japanese police have made no arrest in any of the cases reported since last year.

The agency plans to beef up cooperation with other countries by setting up a unit with investigative authority to tackle cybercrimes in fiscal 2022 from next April.

According to the agency, direct monetary requests were made to companies and others in 29 cases in the first half of 2021. In most cases, targets were told to pay with cryptocurrency such as bitcoin.

There were 27 cases of so-called double extortion, in which hackers demand money by threatening to disclose data they stole, on top of the ransoms for restoration of the encrypted data.

The agency declined to say whether any victims that reported ransomware damage paid the ransom.

Of the total 61 cases in the first half, 17 involved large companies, 40 smaller companies and four school and other organizations.

By industry, 27 cases involved companies in the manufacturing sector, followed by eight in the construction industry and another eight in the service sector.

The agency also conducted its first questionnaire survey on companies and others hit by ransomware attacks.

In 19 cases, companies and others took at least a week to recover from the attacks, while in two cases, at least two months were necessary.

Nearly 40 pct of the surveyed organizations said that restoration and investigation costs totaled 10 million yen or over.

Computers viruses gained access to systems through virtual private network devices, used for teleworking, in most cases, while some viruses spread through malicious email attachments.

The agency detects an average of around 6,000 suspicious accesses per IP address per day. The high number means hackers are actively searching for ways to gain entry into computers to launch cyberattacks.

JIJI Press