Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Wray: FBI Frowns on Ransomware Payments Despite Recent Trend

The FBI’s director told lawmakers Thursday that the bureau discourages ransomware payments to hacking groups even as major companies in the past month have participated in multimillion-dollar transactions aimed at getting their systems back online.

The FBI’s director told lawmakers Thursday that the bureau discourages ransomware payments to hacking groups even as major companies in the past month have participated in multimillion-dollar transactions aimed at getting their systems back online.

“It is our policy, it is our guidance, from the FBI, that companies should not pay the ransom for a number of reasons,” Christopher Wray testified under questioning from members of the House Judiciary Committee.

Besides the fact that such payments can encourage additional cyberattacks, victims may not automatically get back their data despite forking over millions, “and that’s not unknown to happen,” Wray said.

In ransomware attacks, hackers lock up and encrypt a victim’s data and demand a payment in order to return it. They have proliferated in scale over the past year, targeting not just hospitals and police agencies but also critical infrastructure and vital industries. Some recent major corporate targets have responded by paying the ransom, fearing that a prolonged shutdown of their businesses could have catastrophic consequences for the country and disrupt crucial supply chains.

Colonial Pipeline, which transports about 45 percent of fuel consumed on the East Coast, last month paid a ransom of 75 bitcoin — then valued at roughly $4.4 million — in hopes of getting its system back online.

On Wednesday, JBS SA, the world’s largest meat processing company, revealed that it had paid the equivalent of $11 million to hackers who broke into its computer system last month.

Colonial Pipeline CEO Joseph Blount told lawmakers this week that the decision to pay the ransom was the hardest choice of his career but ultimately the right thing to do, particularly given the gas shortages that surfaced within days in parts of the United States. He said that although the key the company was given to decrypt its data did not work perfectly, Colonial has resumed operations after a brief shutdown.

The Justice Department has said it was able to recover the majority of the ransomware payment after locating the virtual wallet used by the hackers. Wray said that in addition to helping companies in that way, the FBI also in certain instances has been able to obtain the encryption keys of hackers and unlock the seized data without any payment being made.

“There are a whole bunch of things we can do to prevent this activity from occurring, whether they pay the ransom or not, if they communicate and coordinate and work closely with law enforcement right out of the gate,” he said. “That’s I think the most important part.”

RelatedFBI Confirms REvil Ransomware Involved in JBS Attack

Written By

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Ransomware

US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...

Ransomware

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.