Cybersecurity Policy Report, U.K. Cyber Regulator Discusses Impacts of Ransomware Attacks, (May 9, 2024)

By Tony Foley

The United Kingdom’s National Cyber Security Centre (NCSC) discussed the impact of ransomware attacks on organizations, particularly in the context of data exfiltration, in a blog post released today.

The post notes that in recent years, threat actors have not only encrypted victims’ computers and networks, they also have stolen data. NSCS said that while headlines often reported the initial damage and disruption caused by such attacks, even after systems are restored, many organizations still find themselves trying to determine what happened to their data.

NCSC maintained that almost all ransomware incidents involved the theft of data from a victim’s network. When a criminal deploys ransomware, NCSC said, organizations should assume that data has been stolen, including, in a worst-case scenario, sensitive personal information. While victims are more likely to pay a ransom if they expect that doing so will both enable them to decrypt the data and ensure that exfiltrated data will not be leaked, recent law enforcement actions have revealed that data from victims who paid a ransom remained on the criminal’s system.

The blog describes the ways in which criminals will post exfiltrated data on the dark web, exposing organizations to fraud or financial loss. In addition, NCSC said many threat actors were simply exfiltrating data for extortion purposes rather than encrypting it. The NCSC emphasized that it was critical for organizations to take steps to defend themselves from ransomware attacks.

News: InternationalLegislation DataSecurity DataBreach