Follow Us Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

Cybersecurity International Law Privacy Technology Media and Telecom

Ransomware – COVID-19 & Upgrading Your Defenses

It’s pretty shameful that in the current crisis we’re seeing ransomware on the rise. It’s even more shameful that organizations involved in fighting the virus seem to be especially at risk.


Thank you for sharing!

Your article was successfully shared with the contacts you provided.

It’s pretty shameful that in the current crisis we’re seeing ransomware on the rise. It’s even more shameful that organizations involved in fighting the virus seem to be especially at risk. Last year ransomware targeted healthcare more than any other industry, accounting for 29% of total ransomware attacks, according to Beazley’s 2020 Breach Briefing report. Recent events suggest that attacks are up as the COVID-19 virus spreads, with criminals working on the theory that an organization desperate to unlock its data is now more likely to pay.

The combined effects of COVID-19 + ransomware have already seen one victim as Travelex entered into administration on Aug. 6, 2020 after having reportedly paid a ransom to hackers. A rescue package was agreed but with the loss of 1,300 jobs. Regrettably it is likely that Travelex will be just the first of many victims.

What Techniques Are Hackers Using?

A ransomware attack uses malware that encrypts or otherwise restricts access to computers, system or data by exploiting system vulnerabilities. The attackers demand that the victim pays money (usually in cybercurrency such as Bitcoin) to receive the decryption key or recover access.

The main ways that a ransomware ‘payload’ can enter an organization’s network are via:

The criminals usually exploit a vulnerability in the operating system or other installed software, which then starts the encryption process.

What’s the Worst That Can Happen?

The impact of a ransomware attack can be severe and far-reaching. For the corporate victim, it can mean business disruption, financial loss and reputational damage. For some it may mean that they are forced to close.

For those whose data has been compromised, this could mean that critical data is rendered inaccessible or disclosed to unauthorized people — in some cases this could include sensitive data.

In terms of data protection law impact, the General Data Protection Regulation (GDPR) imposes key requirements relating to security. Controllers must take appropriate technical and organizational measures (TOMs) to keep personal data secure against loss or destruction.

Where a ransomware attack means that an organization is unable to restore compromised data, this could constitute a breach of GDPR on the basis that appropriate measures have not been taken to keep the data secure.

If a personal data breach has occurred, this will need to be reported by the controller organization to the relevant data protection regulator(s) (in the UK, the Information Commissioner’s Office (ICO)) within 72 hours, unless the personal data breach is unlikely to result in a risk to individuals. If the personal data breach is likely to result in a high risk to individuals, the controller needs to also communicate the breach to individuals whose data has been compromised without undue delay.

It is possible that the incident may not amount to a reportable personal data breach if:

We know that a number of organizations who have suffered a ransomware attack have argued that because the data has not left their systems no data breach has occurred. That’s unlikely to be correct. There’s detailed guidance on this at an EU level. Individual data protection authorities have issued guidance too — for example the ICO’s guidance says that even if it can restore data from back-up an organization “would still need to look at the circumstances of the case to determine whether or not there were appropriate measures in place which could have prevented the attack from succeeding”.

Organizations that fail to meet their security obligations under the GDPR face high fines as follows:

GDPR Provision Requirement Maximum Fines
Article 5(1)(f) For not ensuring that personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’). The higher of €20,000,000 ($23,891,100) and up to 4% of the total worldwide annual turnover of the preceding financial year
Article 32 For not implementing appropriate TOMs to ensure a level of security appropriate to the risk, including as appropriate:

To continue reading,
become a free ALM digital reader

Benefits include:

  • 1 free article* every 30 days across the ALM subscription network
  • Exclusive discounts on ALM events and publications
  • Your choice of 9 email alerts with Breaking News from any of LJN’s best-selling newsletters

*May exclude premium content

Read These Next

  • Enforcement Update: U.S. Courts Demonstrate Reluctance to Extend Application of Chinese Data Security and Privacy Laws In Civil Discovery

    By Jeff Pade and Lindsey Dieselman

    Two recent Chinese laws — the Data Security Law (DSL) and the Personal Information Protection Law (PIPL) — include provisions aimed at restricting the cross-border transfer of China-based data foreign enforcement and judicial authorities. U.S. courts have not yet addressed whether these data protection and privacy laws could bar the production of documents in civil contexts involving governmental litigants or in criminal proceedings.

    Read More ›

  • Mitigating Risks at Professional Service Firms Using Artificial Intelligence

    By Brian P. Piatek

    Truly malicious internal threats can often be treated much like external threats using the tools and backups already in place. But how does a firm proactively identify the softer threats — which may be just as dangerous as the malicious threats and can cripple a firm just as effectively?

    Read More ›

  • The Anatomy of a Supply Chain Cyberattack

    By Brian Schmitt and Abeer Abu Judeh

    Mitigating Its Risks and the Call for Standardization of Software Development Security Protocols

    This article details the anatomy of a supply chain cyberattack, explores the existing state of supply chain protective contractual terms, and proposes actionable steps with a collective approach to guide legal professionals through their precarious endeavors.

    Read More ›

  • We Must Never Let our Cyber Guard Down

    By Emil Sayegh

    When cyber defenses work, there is a human tendency to become complacent. If you fall into this perception trap, you will quickly find yourself in survival mode — scrambling to restore and recover, and in a position where the best explanation was that the attack was somehow “unexpected.” The global cyberthreat is also still very real.

    Read More ›