Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

UK Warns Lawyers Not to Advise Ransomware Payments

The NCSC and the ICO have warned UK lawyers not to advise clients to pay a ransom to cybercriminals

In a letter addressed to UK lawyers dated July 7, 2022, the UK’s National Cyber Security Center (NCSC) and the Information Commissioner’s Office (ICO), have reiterated – with teeth – the official stance on not paying a ransom.

The NCSC and the ICO have warned UK lawyers not to advise clients to pay a ransom to cybercriminals

In a letter addressed to UK lawyers dated July 7, 2022, the UK’s National Cyber Security Center (NCSC) and the Information Commissioner’s Office (ICO), have reiterated – with teeth – the official stance on not paying a ransom.

From the law enforcement standpoint, the letter explains, “Law Enforcement does not encourage, endorse nor condone the payment of ransoms. While payments are not usually unlawful, payers should be mindful of how relevant sanctions regimes (particularly those related to Russia) – and their associated public guidance – may change that position.”

The implicit warning is that sanctions against Russia could technically make payment of a ransom to a Russian cyber gang effectively if not actually illegal. Ignorance of the attackers’ nationality would be a dangerous tactic, since the NCSC specifically states that NCSC is part of GCHQ – and GCHQ, like the NSA, would know.

The law enforcement warning will only apply to companies with a presence in the UK – but other countries operating current sanctions against Russia might take a similar stance.

The second warning refers to the UK data protection regulator, the ICO. In setting regulatory fines, the ICO will normally consider actions taken to mitigate the risk of harm to individuals involved in a data breach. This does not apply to paying a ransom in the hope of recovering personal data stolen in a double extortion attack.

“For the avoidance of doubt,” says the letter, “the ICO does not consider the payment of monies to criminals who have attacked a system as mitigating the risk to individuals and this will not reduce any penalties incurred through ICO enforcement action.”

In short, paying a ransom could leave a company open to charges of sanctions busting, while having no effect on any subsequent ICO enforcement. Given the international nature of GDPR and the UK’s current implementation of the UK GDPR, this would also apply to North American and other countries’ companies who pay a ransom to recover stolen European PII.

Advertisement. Scroll to continue reading.

Related: It Doesn’t Pay to Pay: Study Finds 80% of Ransomware Victims Attacked Again

Related: The Psychology of Ransomware Response

Related: SecurityWeek Cyber Insights 2022: Ransomware

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Ransomware

A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.