Who is the most common victim of a ransomware attack? Not the system administrator, but a manager in their mid-forties. That's the finding of a Zscaler analysis of more than 350 incidents from a campaign that lasted about a month.
The target profile in numbers
- Almost two thirds of victims hold management positions.
- More than 60% are in leadership roles or work in departments that give an attacker useful access.
- Around 75% work in accounting and finance, sales, operations, HR or marketing.
- The largest shares: finance 17.7%, sales 17.4%, operations 16.8%.
- By sector: manufacturing 35.5%, IT 14.6%.
Attacks often target several employees at once. The logic is simple: the attacker is looking for the person who handles invoices, contracts and customer data.
Extortion is overtaking encryption
Zscaler reports a 146% increase in blocked ransomware attempts on its cloud platform over the past year. Publicly disclosed extortion cases are up 70%, and the volume of stolen data is up 92%. In other words, attackers increasingly steal the data first and then threaten to publish it, rather than just locking the files.
What this means for businesses
The analysis doesn't make specific recommendations, but the data points to a few obvious priorities. Here's how we would rank them for a small or mid-sized business:
- Train leadership, not just staff. If managers are the main target, they need to be the first to recognise phishing and suspicious requests.
- Segment access. Financial, customer and contract data shouldn't be reachable from every account.
- Protect your email. Properly configured SPF, DKIM and DMARC make it harder for anyone to send emails in your domain's name.
- Backups an attacker can't delete. A copy outside your main infrastructure and a tested restore process.
Your website is part of the perimeter too
Contact forms, customer accounts in your online store and your site's admin panel are all entry points. That's why on every project we set up spam protection, login attempt limits and two-factor authentication for administrators. You can read more about our approach on the website maintenance page.
Related: a practical checklist for Bulgaria's Cybersecurity Act.
Source: Digitalk: The most common target of ransomware attacks (in Bulgarian). This article is an independent analysis by Penkov Studio.
