tools. In addition, old copies of files may exist on the disk, which has been previously deleted. In some cases, these deleted versions may still be recoverable using software designed for that purpose. Growth Ransomware malicious software was first confined to one or two countries in Eastern Europe and subsequently spread across the Atlantic to the United States and Canada. The number of cyberattacks during 2020 was double that of 2019. The first versions of this type of malware used various techniques to disable the computers by locking the victims system machine (Locker Ransomware) [133]. Ransomware uses different tactics to extort victims. One of the most common methods is locking the device's screen by displaying a message from a branch of local law enforcement alleging that the victim must pay a fine for illegal activity. The ransomware may request a payment by sending an SMS message to a premium rate number. Some similar variants of the malware display pornographic image content and demanded payment for the removal of it. In 2016, a significant uptick in ransomware attacks on hospitals was noted. According to the 2017 Internet Security Threat Report from Symantec Corp, ransomware affected not only IT systems but also patient care, clinical operations, and billing. Online criminals may be motivated by the money available and sense of urgency within the healthcare system. Ransomware is growing rapidly across the internet users but also for the IoT environment. The big problem is that millions of dollars are lost by some organizations and industries that have decided to pay, such as the Hollywood Presbyterian Medical Center and the MedStar Health. According to Symantec 2019 ISTR report, for the first time since 2013, in 2018 there was an observed decrease in ransomware activity with a drop of 20 percent. Before 2017, consumers were the preferred victims, but in 2017 this changed dramatically, it moved to the enterprises. In 2018 this path accelerated with 81 percent infections which represented a 12 percent increase. The common distribution method today is based on email campaigns. The first reported death following a ransomware attack was at a German hospital in October 2020. An effective and successful cyber awareness training program must be sponsored from the top of the organization with supporting policies and procedures which effectively outline ramifications of non-compliance, frequency of training and a process for acknowledgement of training. Without sponsorship from the “C-level” executives the