It doesn’t take a ski mask or a weapon to hold a company hostage. A few lines of malicious code can be just as devastating. Today’s ransomware attacks are digital kidnappings, where cybercriminals hold an organisation’s most valuable asset — its data — for ransom. And unlike traditional kidnappings, these attackers can strike from anywhere on the globe, invisible, anonymous, and ruthlessly effective.
Ransomware incidents have surged dramatically across the Asia-Pacific region. IDC research published in September 2024 found that nearly 60% of APAC enterprises experienced ransomware attacks in 2023, making it one of the fastest-growing cyber threats in the region.
These attacks don’t just lock up data — they paralyse organisations. Factories have halted production. Hospitals have been unable to treat patients. City governments have lost access to critical services overnight.
And ransomware isn’t just a technology problem — it’s a security failure that impacts operations, customers, compliance, and reputation. Attackers don’t just exploit software vulnerabilities; they exploit untrained employees, poor planning, and leadership indecision. They count on chaos.
In other words, ransomware is no longer merely a technical problem for IT departments. It’s an existential threat, an operational crisis, and a security nightmare that every executive must take seriously.
Inside a Typical Ransomware Attack: The Handa Hospital Case
Most attacks follow a familiar arc. They often begin quietly, through a phishing email or an unpatched internet-facing system. Once attackers are inside, they move fast. Recent industry data puts the median time from initial access to ransomware deployment at around five days.
For example, in October 2021, Handa Hospital in Japan — a small regional medical centre — became the target of a devastating ransomware attack.
Stage 1: Initial Compromise (Long Before Anyone Noticed)
Attackers gained access through the hospital’s VPN appliance, exploiting a known Fortinet vulnerability (CVE-2018-13379) that had been public for three years. Two vendors shared responsibility for the system, and the hospital’s own investigation found that both knew about the flaw, each assumed it was the other’s job, and neither told the hospital. Antivirus software had been installed but left switched off across roughly 200 endpoints after it clashed with the electronic records system — leaving critical systems exposed.
Stage 2: Silent Intrusion and Setup
Once inside, the attackers moved laterally through the network, escalating privileges and staging the ransomware payload. They carefully avoided detection, biding their time until the moment of maximum disruption.
Stage 3: The Attack (Just After Midnight)
In the early hours of the morning — when IT support was unavailable — attackers launched the ransomware. Systems locked up across the hospital. Printers began spewing threatening ransom notes in English. Staff were stunned. Within hours, medical records, prescriptions, and even backup systems were inaccessible.
Stage 4: Operational Breakdown (Morning)
Surgeries were deferred. Patients had to be transferred. Doctors reverted to handwritten notes and records, highly prone to human error. The hospital couldn’t even identify patients who were scheduled to arrive that day. Suddenly, the staff weren’t just treating patients — they were managing a crisis as critical as a natural disaster.
The hospital chose not to negotiate. It took months to recover. The hospital lost access to data for over 85,000 people, and the town committed more than ¥200 million — roughly USD 1.8 million — to building a new system rather than paying the ransom.
At the end of the day, ransomware doesn’t just encrypt data — it compromises trust, safety, and stability. It creates organisational trauma that can take years to recover from, if at all.
(You can watch the full story about the Handa Hospital ransomware case in the CNA documentary “Click To Ransom”, featuring Blackpanda CEO Gene Yu.)
Who Gets Targeted by Ransomware and Why
The more sophisticated ransomware attackers often strategically choose their targets based on the likely payoff as a factor of the following three criteria: vulnerability, urgency, and sensitivity. They look specifically for organisations with the greatest potential for disruption and the highest motivation to pay.
- Vulnerability: Attackers constantly scan the digital landscape for organisations that have left their digital “doors” unlocked — companies with weak cybersecurity practices or unnoticed vulnerabilities. SMEs are often easy targets, due to outdated software, weak passwords, phishing risks, or lack of cybersecurity planning.
- Urgency: Attackers frequently target organisations where downtime causes immediate and severe disruption, focusing on businesses that have no margin for error and experience substantial financial losses or operational chaos with every minute offline. For example, manufacturing firms rapidly lose revenue when production stops, retail and e-commerce businesses instantly lose sales if their systems go offline, and logistics providers quickly face operational delays and unhappy customers.
- Sensitivity: Organisations holding sensitive or confidential information — like financial firms, law practices, or healthcare providers — face extreme pressure from regulatory fines and reputational damage if data is leaked. Attackers leverage this fear to secure quick payment.
In short, ransomware criminals often act as strategic opportunists, deliberately targeting organisations that simply cannot afford to say “no.” Understanding why these targets are chosen is essential to strengthening defences and preparing your organisation against becoming the next victim.
…And Why Sometimes, It’s Just Random
Not all attacks are carefully targeted. Some attackers work by volume rather than selection. They scan the internet continuously for exposed services — VPN gateways, unpatched firewalls, forgotten remote-access portals — and attempt to attack what they find.
In the case of Handa Hospital, the CNA documentary reports that the attack was not a targeted extortion attempt, but part of a broader proof-of-concept campaign by ransomware group LockBit. As a Ransomware-as-a-Service (RaaS) provider, LockBit was likely demonstrating the effectiveness of its ransomware product by launching real-world attacks — even on smaller, random organisations — to attract new criminal affiliates.
On that account, the hospital was never the real target; it was collateral damage in a sales pitch.
These proof-of-concept attacks are part of how the ransomware economy works: anyone, regardless of intent or skill, can purchase a ready-made ransomware kit on the dark web and deploy it against whoever’s vulnerable.
So even if you don’t see your business as a prime ransomware target, you can still become a victim by chance — making proactive defence and response critical for every business.
How to Make Yourself a Harder Target
Ransomware can feel overwhelming — especially for smaller organisations without in-house cybersecurity teams. But you don’t need a massive budget or deep technical expertise to make yourself a harder target.
Below are immediate steps you can implement today to significantly strengthen your defences:
1. Regularly Update and Patch Your Software
Attackers often enter through known software flaws that simply haven’t been fixed. Regular software updates remove easy entry points — but you can do even better by identifying vulnerabilities through Attack Surface Readiness (ASR), which maps what attackers can see of your environment and rescans it weekly, so gaps surface before anyone exploits them.
2. Use Strong Passwords + MFA
Strong, unique passwords combined with multi-factor authentication (MFA or 2FA) significantly reduce your risk of unauthorised access. Even if attackers steal credentials, MFA creates an extra barrier protecting your critical data.
Whenever possible, use Passkeys, a modern, phishing-resistant authentication method that replaces traditional passwords with cryptographic key pairs. Passkeys simplify login experiences while significantly improving security, especially against credential theft and social engineering attacks.
3. Train Your People
Ransomware often starts with an innocent click. Regularly train employees to spot phishing emails, use secure passwords, and report suspicious activity. A little awareness can go a long way.
4. Maintain Regular, Secure Offline Backups
Secure offline backups remove much of an attacker’s leverage. If your data is held hostage, you can restore critical systems without paying a ransom — if those backups are recent, tested, and kept offline.
5. Use Endpoint Detection and Response (EDR) for Visibility and Containment Laptops, desktops, and servers remain among the most common entry points for attackers. Modern EDR goes far beyond simple signature-based defence and includes its own antivirus engine, providing deep forensic and process-level visibility, enabling defenders to investigate incidents in real time. These platforms also incorporate containment capabilities, automatically isolating infected endpoints to prevent lateral movement. But EDR is not a set-and-forget control — someone has to be watching the alerts, whether that’s your own team or a managed service.
6. Be Prepared to Respond
When a ransomware attack hits, you don’t want to be scrambling for help. Every hour lost to confusion, delay, or miscommunication can dramatically increase the cost, scope, and chaos of the incident. That’s why it’s essential to have experienced incident responders on standby — professionals who can contain the damage, negotiate with attackers, and confidently guide you through the entire process.
Blackpanda IR-1: Built for Ransomware
Blackpanda created IR-1 to address a simple but urgent question: Why doesn’t every business have access to top-tier cyber emergency response?
IR-1 is our answer to the unacceptable status quo. It’s a fixed-cost subscription that gives companies of any size direct access to Asia’s premier incident response team — including one guaranteed full-scale incident response per year. No hourly billing. No delays. No red tape.
At roughly 10x less expensive than traditional retainers, IR-1 gives you a full-scale cyber fire department ready to deploy, 24/7.
But our standard IR-1 offering goes beyond incident response. It also includes:
- Attack Surface Readiness (ASR), with weekly external scans to help you identify security vulnerabilities before attackers strike.
- Dark Web Monitoring to detect leaked credentials and emerging threats.
- Automated Cyber Insurance Estimates, giving you a streamlined path to financial recovery if the worst happens.
With one-click activation, 24/7 availability, and no surprise billing, IR-1 is your ransomware response guarantee for when cyber crises strike. (Learn more about Blackpanda IR-1.)
Conclusion: Don’t Wait for the Ransom Note
Ransomware is a present and accelerating reality. Whether your organisation is targeted directly or caught in the crossfire, the outcome is the same: operational chaos, reputational harm, and costly recovery.
But while the threat is complex, your first steps don’t have to be. Strong passwords, regular updates, employee training, secure backups, and an expert response team on call — these are the basics that can turn a crisis into a contained incident.
Most of all, don’t assume you’ll rise to the occasion under pressure. Ransomware thrives on hesitation. The time to prepare isn’t after the note arrives — it’s now.
To learn more about Blackpanda and how IR-1 can help your organisation prepare, prevent, and respond to ransomware, speak to our team.
About Blackpanda
Blackpanda is a Lloyd's of London–accredited insurance coverholder and Asia's leading local cyber incident response firm, delivering end-to-end digital emergency support across the region. We are pioneering the A2I (Assurance-to-Insurance) model in cybersecurity — uniting preparation, response, and insurance into a seamless pathway that minimises financial and operational impact from cyber attack. Through expert consulting services, response assurance subscriptions, and innovative cyber insurance, we help organisations get ready, respond, and recover from cyber attacks — all delivered by local specialists working in concert.
Our mission is clear: to bring complete cyber peace of mind to every organisation in Asia, from the first moment of breach through full recovery and beyond.
