{"id":7508,"date":"2021-08-02T10:50:07","date_gmt":"2021-08-02T10:50:07","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7508"},"modified":"2021-08-02T10:50:08","modified_gmt":"2021-08-02T10:50:08","slug":"is-it-legal-to-pay-ransomware-demands","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/is-it-legal-to-pay-ransomware-demands\/","title":{"rendered":"Is it legal to pay ransomware demands?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7508\" class=\"elementor elementor-7508\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Ransomware attacks are increasing in frequency, scope, and severity. Ransomware demands are also getting higher, and desperate companies are paying up in order to try to get to normal as quickly as possible.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The official stance from governments and law enforcement agencies has always been that companies shouldn\u2019t pay the ransomware demand, but that doesn\u2019t actually answer the question, is it legal to pay ransomware demands following a ransomware attack?<\/span><\/p><p><span style=\"font-weight: 400;\">Tl;dr &#8211; yes.<\/span><\/p><p><span style=\"font-weight: 400;\">But it is more complicated than that.<\/span><\/p><h2><span style=\"font-weight: 400;\">Does anyone actually pay ransomware demands?<\/span><\/h2><p><span style=\"font-weight: 400;\">Yes, they do. The average ransom paid to unlock networks rose by 270% from $115,123 in 2019, to $312,493 in 2020, suggesting that people are paying, and ransomware gangs know they can ask for more money.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Not every attack comes with a high ransomware demand, the vast majority are relatively small, but some ransomware gangs have demanded (and received) millions of dollars in ransoms:<\/span><\/p><p><span style=\"font-weight: 400;\">US infrastructure company <\/span><a href=\"https:\/\/www.theguardian.com\/technology\/2021\/may\/19\/colonial-pipeline-cyber-attack-ransom\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Colonial Pipeline<\/span><\/a><span style=\"font-weight: 400;\"> paid DarkSide over $4.4 million in June 2021 after a ransomware attack that brought one of the main oil pipelines in the Eastern United States to a standstill.<\/span><\/p><p><span style=\"font-weight: 400;\">UK foreign exchange company <\/span><a href=\"https:\/\/www.bbc.co.uk\/news\/business-51017852\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Travelex<\/span><\/a><span style=\"font-weight: 400;\"> paid <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">REvil<\/span><\/a><span style=\"font-weight: 400;\"> (Sodinokobi) a final ransom of $2.3 million in January 2020, down from an initial demand of $6m. The impact of the cyber attack, ransomware demand, and loss of reputation later pushed the company into administration.<\/span><\/p><p><span style=\"font-weight: 400;\">In May 2021, US insurance company <\/span><a href=\"https:\/\/www.techradar.com\/uk\/news\/cna-financial-pays-out-one-of-the-biggest-ransomware-payments-ever\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CNA Financial<\/span><\/a><span style=\"font-weight: 400;\"> is reported to have paid a ransomware demand of $40 million to the operators of the Phoenix Locker ransomware. This attack like many others was a double extortion attack, making it more important to CNA Financial to stop the attack.<\/span><\/p><p><span style=\"font-weight: 400;\">And from the other side, the admins of <\/span><a href=\"https:\/\/www.teiss.co.uk\/ziggy-ransomware-admin-to-refund-victims\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Ziggy ransomware<\/span><\/a><span style=\"font-weight: 400;\"> closed operations back in April 2021 returning ransoms to former victims. One of the reasons posited for why Ziggy ceased operations is that they had reached their profit target, meaning that plenty of organisations had paid the ransomware demand over time.<\/span><\/p><h2><span style=\"font-weight: 400;\">What is a ransomware attack?<\/span><\/h2><p><span style=\"font-weight: 400;\">A ransomware attack is when malware infects a computer, locks or encrypts systems, files, and parts of the network, and demands the victim pays a ransom in order to unlock it. Ransomware can be delivered through a phishing campaign, malware, or even through direct hacks into a victim\u2019s systems.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Victims will often pay a ransom if they don\u2019t have a backup in place, or if their backup is also compromised in the attack.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">More recently, ransomware attackers have used double extortion to convince victims to pay, by stealing data before they encrypt it. This enables the attackers to claim a ransom even if the organisation decides not to pay to unlock their files. This form of ransomware is arguably more damaging as the data could be viewed as more valuable than the systems.<\/span><\/p><h2><span style=\"font-weight: 400;\">What is the result of organisations paying ransomware demands?<\/span><\/h2><p><span style=\"font-weight: 400;\">Paying up makes the criminals bolder. Receiving a payment shows them that the model works, and makes it profitable to try again.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">In 2021 so far we have seen unprecedented numbers of ransomware attacks, featuring new techniques and sophistication as the ransomware gangs put more resources into making their attacks successful because they are certain they will receive a payment at the end of it.<\/span><\/p><p><span style=\"font-weight: 400;\">Paying up may make an organisation more vulnerable to future attack simply because it is known that they will pay up. Many cyber criminals are opportunistic. If they spot an easy mark, they will go for it. In fact, research suggests that <\/span><a href=\"https:\/\/threatpost.com\/ransomware-victims-dont-pay-up\/166989\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">80% of organisations<\/span><\/a><span style=\"font-weight: 400;\"> who have paid a ransomware demand have been <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/attack-isnt-over-until-post-event-analysis-says-so\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">hit a second time<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">Many of the organisations who pay ransomware demands pay them through their cyber insurance. While this reduces the burden of the payment on the individual company, insurance companies are now <\/span><a href=\"https:\/\/www.darkreading.com\/risk\/ransomware-losses-drive-up-cyber-insurance-costs\/d\/d-id\/1341436\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">raising premiums for cyber insurance<\/span><\/a><span style=\"font-weight: 400;\">, and increasing the list of cyber security demands for companies looking to get insured.<\/span><\/p><p><span style=\"font-weight: 400;\">Cyber insurance has also created a situation whereby ransomware gangs tailor their ransomware demand to the maximum coverage amount included in the policy. This in turn has pushed up ransom amounts.<\/span><\/p><p><span style=\"font-weight: 400;\">In addition, some insurance companies are also limiting the cyber attacks they will cover. For example, <\/span><a href=\"https:\/\/www.insurancejournal.com\/news\/international\/2021\/05\/09\/613255.htm\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">insurance firm AXA announced in May<\/span><\/a><span style=\"font-weight: 400;\"> that it will no longer pay out to French customers who pay the ransom extorted in a ransomware attack.<\/span><\/p><h2><span style=\"font-weight: 400;\">Why doesn&#8217;t the government make paying ransoms illegal?<\/span><\/h2><p><span style=\"font-weight: 400;\">The<\/span><a href=\"https:\/\/www.bbc.co.uk\/news\/technology-57173096\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\"> discussion to ban ransom payments<\/span><\/a><span style=\"font-weight: 400;\"> has been raised time and again, but there are several key considerations that have prevented making paying the ransomware demand illegal.<\/span><\/p><p><span style=\"font-weight: 400;\">Ransomware demands are usually paid by organisations who have no other choice. If they didn\u2019t pay the ransom they would be unable to recover their files, and they would have to go out of business. While some businesses may take that route, others may look for undercover or black market ways to pay ransomware demands.<\/span><\/p><p><span style=\"font-weight: 400;\">Other organisations such as <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/warning-ransomware-attacks-may-cost-lives\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">hospitals pay ransoms<\/span><\/a><span style=\"font-weight: 400;\"> because they can\u2019t afford the downtime caused by encrypted systems. If governments banned ransom payments, these organisations would be caught in lengthy negotiations that they can ill-afford. They may also become more attractive targets to cyber criminals who are looking to maximise the chances of getting paid.<\/span><\/p><p><span style=\"font-weight: 400;\">Ransomware gangs are usually in it for the money. When they don\u2019t get the easy ransom, they escalate the scope and severity of the attack &#8211; including double extortion attacks.\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">So, is it legal to pay the ransom in a ransomware attack?<\/span><\/h2><p><span style=\"font-weight: 400;\">Yes &#8211; for now. It is currently <\/span><a href=\"https:\/\/www.verdict.co.uk\/ransomware-payment-illegal\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">not illegal to pay ransomware demands<\/span><\/a><span style=\"font-weight: 400;\">, but there are a number of financial sanctions and legislation in place that makes it a grey area.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/www.welivesecurity.com\/2021\/07\/08\/ransomware-pay-not-pay-legal-illegal-these-are-questions\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">US Treasury<\/span><\/a><span style=\"font-weight: 400;\"> stated in 2020 that facilitating ransomware payments to sanctioned hackers may be illegal. Similarly in the EU, cyber criminal groups may have financial sanctions placed on them, and it is a criminal offence to breach a financial sanction.\u00a0<\/span><\/p><p><a href=\"https:\/\/www.osborneclarke.com\/insights\/ransomware-pay-not-pay\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">The UK the Terrorism Act 2000<\/span><\/a><span style=\"font-weight: 400;\"> makes it illegal to pay a ransom when there is a suspicion that it is linked to terrorism. Terrorism in this case is defined as an act (including interference or disruption of an electronic system) which is designed to influence government in order to advance a political, religious, racial, or ideological cause.\u00a0<\/span><span style=\"word-spacing: normal;\">When dealing with anonymous cyber criminals, it is impossible to know what their true aims are.<\/span><\/p><p><span style=\"font-weight: 400;\">Equally, it may not be worth it to pay a ransomware demand. Ransomware gangs\u2019 decryptors are notoriously buggy, and research has found the organisations are <\/span><a href=\"https:\/\/www.insurancejournal.com\/news\/international\/2021\/07\/08\/620508.htm#\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">able to recover just 65% of files<\/span><\/a><span style=\"font-weight: 400;\"> on average.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Only 8% of organisations recovered all their data after paying a ransom. Furthermore, the computers will still be infected, adding further costs to remove any malware before an attack happens again.<\/span><\/p><h2><span style=\"font-weight: 400;\">Protect, don\u2019t pay<\/span><\/h2><p><span style=\"font-weight: 400;\">At the end of the day, the best way to recover from a ransomware attack is to prepare for it. Organisations should take the perspective that it is when, not if a ransomware gang will attempt to infiltrate their network, and put in precautions accordingly. These include:<\/span><\/p><p><b style=\"word-spacing: normal;\">Protect your network<\/b><\/p><p><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Invest in network protections<\/span><\/a><span style=\"font-weight: 400;\"> such as firewalls and VPNs, endpoint or device protection, secure authentication, and a monitoring regime, and create an effective <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity risk management programme<\/span><\/a><span style=\"font-weight: 400;\">. Consider the services of a cyber intelligence service to keep up to date with the latest threats and mitigation techniques.<\/span><\/p><p><span style=\"font-weight: 400;\">Include employee training in protection methods, teaching them good cyber hygiene practices including strong passwords, MFA, and how to detect phishing attacks.<\/span><\/p><p><b>Protect your data<\/b><\/p><p><span style=\"font-weight: 400;\">More recent ransomware attacks have used double extortion &#8211; stealing data before encrypting it so that even if an organisation can restore from backups without paying the ransom, the attackers still have leverage. Add extra protections to data including encryption of sensitive data.<\/span><\/p><p><b>Prepare for an attack<\/b><\/p><p><span style=\"font-weight: 400;\">Prepare a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">ransomware incident response playbook<\/span><\/a><span style=\"font-weight: 400;\"> that contains all the relevant information, tasks, and communications that will help the incident response team respond to the attack, including the critical systems to protect or restore and checklists of tasks to follow in an event. Carry out table top or simulation exercises to rehearse the plan.<\/span><\/p><p><span style=\"font-weight: bold;\">Prioritise your backup strategy<\/span><\/p><p>Ransomware attackers encrypt data, and demand the ransom to restore it, but if an organisation has recent, available backups they have no need to pay the ransom demand. Create a regular backup schedule that saves the backups offline or in a different network to the main company networks.\u00a0<span style=\"word-spacing: normal;\">If possible, create more than one copy of the backup. Test the backups and ensure that they are easily restorable.<\/span><\/p><p><span style=\"font-weight: 400;\">In today\u2019s world, ransomware may be unavoidable. Paying the ransomware demand, however, is.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Ransomware attacks are increasing in frequency, scope, and severity. Ransomware demands are also getting higher, and desperate companies are paying up in order to try to get to normal as quickly as possible.&nbsp; The official stance from governments and law enforcement agencies has always been that companies shouldn\u2019t pay the ransomware demand, but that doesn\u2019t&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7520,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7508"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7508"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7508\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7520"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7508"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7508"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}