Ransomware
Also called cyber extortion, ransom malware
Ransomware is malicious software that encrypts or steals an organisation's data and demands a payment, usually in cryptoassets, to restore access or stop publication. For financial firms it is an operational resilience, sanctions and reporting issue: paying can breach sanctions, and many regulators require notice of attacks and of any payment.
How it works
Attackers usually get in through phishing, stolen credentials or unpatched systems, then move across the network, copy data and encrypt systems. Many groups use double extortion, threatening to publish stolen data if the victim does not pay. Some operate as ransomware-as-a-service, renting their tools to affiliates. Firms defend with patching, multi-factor authentication, network segmentation, monitoring and offline backups that let them restore without paying.
When an attack happens, the firm activates its incident response plan, contains the damage, restores critical services and assesses what data was taken. Any decision to pay needs sanctions screening of the attackers and wallets, because a payment to a sanctioned person is a violation even if made unknowingly. Firms notify regulators within set deadlines, report to law enforcement and, where personal data is affected, notify data protection authorities and customers.
The rules
OFAC strongly discourages ransom payments, warns that sanctions violations carry strict liability, and treats prompt reporting to law enforcement and cooperation as significant mitigating factors.
Victims, financial institutions, insurers and incident response firmsRequires notice of cybersecurity incidents within 72 hours, notice of any extortion payment within 24 hours, and a written explanation of why payment was needed, alternatives and sanctions diligence within 30 days.
Banks, insurers and other entities licensed by the New York Department of Financial ServicesMajor ICT incidents, including ransomware attacks that meet the thresholds, need an initial notice within 4 hours of classification, an intermediate report within 72 hours and a final report within one month.
EU financial entitiesThe government confirmed plans for a targeted ban on ransom payments by public bodies and critical national infrastructure, a payment prevention regime and mandatory incident reporting; legislation is not yet in force.
Public sector bodies, critical national infrastructure operators and other UK organisationsCommon questions
Is it illegal to pay a ransom?
Paying is not banned outright in the US, EU or UK for most firms, but a payment to a sanctioned person or country is a sanctions violation. The UK plans a ban for public bodies and critical national infrastructure operators.
Who must be told about a ransomware attack?
Depending on the firm, notice may go to the financial regulator, the data protection authority, law enforcement and affected customers. New York's DFS also requires notice within 24 hours of any extortion payment.
Does cyber insurance cover ransom payments?
Some policies cover extortion payments and recovery costs, subject to terms and exclusions. Insurers and their advisers still have to screen payments for sanctions, and OFAC's advisory applies to them as facilitators.
