Businesses are being urged not to pay cyber extortionists as authorities say they are seeing evidence of a rise in ransomware payments.
In a joint letter to the Law Society, the National Cyber Security Centre (NCSC) and the Information Commissioner’s Office are warning solicitors who may have been advising their clients to pay.
It follows earlier this year cyber security experts from the UK, US, and Australia warning of a “growing wave of increasingly sophisticated ransomware attacks” which could have “devastating consequences”.
The joint letter states that while ransomware payments are “not unusually unlawful” those who pay them “should be mindful of how relevant sanctions regimes (particularly those related to Russia)” when considering making the payment.
The US sanctioned in December 2019 any financial dealings with a Russian cyber crime group that was accused of working with with Russian intelligence to steal classified government documents.
Despite the spillover from the Russian war in Ukraine – in one case knocking 5,800 wind turbines in Germany offline – the NCSC says it has not detected any increase in hostile activity targeting Britain during the conflict.
Businesses however had been warned that there is a heightened threat level when it comes to cyber attacks due to the conflict which is likely to be here “for the long-haul”.
Lindy Cameron is the head of the UK’s National Cyber Security Centre. Pic: NCSC
NCSC’s chief executive, Lindy Cameron, said: “Ransomware remains the biggest online threat to the UK and we do not encourage or condone paying ransom demands to criminal organisations.
“Unfortunately we have seen a recent rise in payments to ransomware criminals and the legal sector has a vital role to play in helping reverse that trend.
“Cyber security is a collective effort and we urge the legal sector to work with us as we continue our efforts to fight ransomware and keep the UK safe online.”
Ms Cameron previously warned that the challenge ransomware gangs posed to law enforcement was “acute” as “the criminals responsible often operate beyond our borders, are increasingly successful in their endeavours”.
“We expect ransomware will continue to be an attractive route for criminals as long as organisations remain vulnerable and continue to pay,” she said at the time.
While there have been arguments made for criminalising the payment of ransoms, it poses a number of additional risks such as providing the criminals with an additional factor they could use to extort their victims.
John Edwards is the UK’s Information Commissioner
John Edwards, the Information Commissioner, added: “Engaging with cyber criminals and paying ransoms only incentivises other criminals and will not guarantee that compromised files are released.
“It certainly does not reduce the scale or type of enforcement action from the ICO or the risk to individuals affected by an attack,” he added, responding to suggestions that some solicitors have told their clients that paying the criminals would be seen as a move to protect users’ data.
“We’ve seen cyber crime costing UK firms billions over the last five years,” the commissioner stated.
“The response to that must be vigilance, good cyber hygiene, including keeping appropriate back up files, and proper staff training to identify and stop attacks
“Organisations will get more credit from those arrangements than by paying off the criminals.
“I want to work with the legal profession and NCSC to ensure that companies understand how we will consider cases and how they can take practical steps to safeguard themselves in a way that we will recognise in our response should the worst happen.”