New feature rolled out to keep Google users worldwide safe from ransomware attacks

SINGAPORE – Google has rolled out a new security feature to stop the automatic syncing of files to the cloud when ransomware or malware is detected in users’ computers, allowing them to recover from the attack without losing access to their data.

Millions of paying Google users around the world, including those in Singapore, are expected to benefit from this service, which was rolled out on Sept 30.

Ransomware is a type of malware that hackers use to lock a victim’s files or computers. Hackers then demand a ransom in exchange for restoring access.

Traditional antivirus tools do not protect users adequately from ransomware as these tools can only pick up known malware.

When malware slips past the antivirus tools, there is no stopping it from reaching files on the cloud.

“Google’s entirely new ransomware protection will deny these attacks the oxygen needed to spread across networks,” said a Google spokeswoman.

“Antivirus tools will continue to focus on keeping the ransomware out. (But) our new defences will keep ransomware from doing damage if it gets in.”

The tech update comes on the heels of a global surge in ransomware incidents and malware infection in 2024.

A report published on Sept 3 by the Cyber Security Agency of Singapore (CSA) showed that the number of systems here infected by malware leapt to 117,300 in 2024, a 67 per cent spike from about 70,200 in 2023.

Most of the incidents occurred because users had failed to update vulnerable software.

The CSA report also showed that the number of ransomware incidents in Singapore rose by more than 20 per cent to 159 in 2024, mirroring rising global trends.

Globally, the number of ransomware attacks in 2024 surged to record levels, as cyber criminals did not just target big corporations, but also went after hospitals, financial institutions and government agencies.

That year, 5,414 published ransomware attacks on organisations worldwide were recorded, representing an 11 per cent increase from 2023, according to a report by Cyberint, a unit of cyber-security company Checkpoint.

“Ransomware remains one of the most damaging cyber threats facing organisations today,” said Google on Sept 30.

“These attacks can lead to substantial financial losses, operational downtime, and data compromise that impacts organisations of all sizes and industries, including healthcare, retail, education, manufacturing and the public sector.”

Nearly 90 per cent of organisations surveyed in the Asia-Pacific, including Japan, hit by ransomware learnt of the attack only from an outsider, such as law enforcement agencies, according to an investigation done by cyber-security firm Mandiant in 2024.

The investigation was conducted over the entire year, and analysed data collected from more than 450,000 incident response engagements globally.

With Google’s new feature, affected users will receive a pop-up notification when ransomware has been detected in Google Drive, or they may be alerted via an e-mail.

Following ransomware detection, the syncing of files to the cloud will be automatically paused to prevent other data from being corrupted.

Then users will be guided to restore previous uninfected versions of the files to undo the damage caused by ransomware.

The new security feature works on Google’s proprietary artificial intelligence model, which has been trained on millions of real-world ransomware samples.

They include past cases from its customer base, and training data from Mandiant and online security tool VirusTotal, said Google Workspace’s group product manager, Mr Luke Camery.

The detection engine can look for signals that a file has been maliciously modified and continuously analyse file changes, said Google.

There are more than three billion monthly active Google Workspace accounts globally, giving users access to tools such as Gmail, Google Calendar and Google Drive. More than 11 million of these global accounts belong to paying organisations. The company declined to share how many Google account users there are in Singapore.

“(They) face the same ransomware threats as so many other companies around the globe. Whether it’s a hospital, a manufacturing company or a small business, attackers are relentless in their attacks,” said the spokeswoman.

“Our new defence stops the encrypted files from being uploaded into Drive, allowing the user to get back to work more quickly and eliminating the impact on collaborators.”