CYBER THREATS RANSOMWARE: A CONTINUING INCREASING TREND IN SOPHISTICATED EXTORTION ATTACKS In a global perspective, the number of targeted extor­ tion attacks grew significantly in 2020 to the detriment of large-scale ransomware campaigns. Extortion malware received maximum attention in the Czech Republic in March 2020, when the networks of the University Hospital Brno and the Psychiatric Hospital in Kosmonosy were encrypted (for details, see the chapter Cyber Incidents from the Perspective of the NÚKIB). The state enterprise Povodí Vltavy and the Prague 3 district town hall were attacked a month later. Although they occurred on the very same day, no link has been identified between the two attacks. During the attack on Povodí Vltavy, which falls under the Ministry of Agriculture, critical information infra­ structure elements were not compromised so the operation of dams and drinking water supplies was not interrupted.xi The attack on the Prague 3 town hall temporarily put the operation of the CzechPoint system in its territory out of service and caused its website and several other systems to fail.xii Apart from those incidents, the NÚKIB most frequently participated in dealing with the impacts of ransomware attacks in the public sector, particularly at the local and regional authorities, healthcare, industry, digital services, and education levels. Both the number of extortion attacks handled by the NÚKIB and other verified sources indicate that the Czech Republic was also affected by the globally rising trend in ransomware attacks in 2020. 28% of the respondents faced a ransomware attack or an attack attempt in 2020. Just under one-fifth of the organisations which encountered a ransomware attack or an attack attempt classified it as the most serious, serious or moderate type of attack (Chart 16). This is a relatively low number of respondents, which might be caused by the fact that two-thirds of the or­ ganisations did not detect any ransomware attacks but more frequently faced other types of attacks, which they subsequently considered more serious. Compared to the global boom of extortion attacks, the lower de­ tection frequency in the Czech Republic might be due to the focus of ransomware operators on Western Europe, the Middle East, and the USA. The chances of getting the ransom paid are higher in those areas, inter alia because organisations can benefit from insurance against extortion attacks in most countries, while on the contrary, in the Czech Republic many insurance companies exclude compensation for damage caused by ransomware attacks in their terms and conditions and also reject ransom payments for ethical reasons. 28% of the respondents said they had detected a ransomware attack or attack attempt in 2020 Chart 16: Percentage of respondents who classified ransomware attacks as most serious in 2019 and 2020 (%) 2019 10% 2020 6% Nevertheless, institutions important for the smooth functioning of the State, such as state institutions, hospitals and energy, industrial and telecommunication companies, are also the targets of attackers. Attackers are highly likely (75% – 85% probability) to continue to concentrate on them because of the higher chances of getting the ransom paid. Besides more targeted ransomware attacks, the global trend of sensitive data theft and then repeated extortion Cyber Threats 16