Several recent major cyberattacks have led to new calls for banning ransom payments. The attacks have disrupted businesses, caused supply chain ripples in the US economy, and wreaked havoc on hundreds of companies. Most notably, oil and gas transport network Colonial Pipeline and meat producer JBS USA were attacked within a month of each other. Both organizations paid massive ransoms to the perpetrators of $4.4 million and $11 million respectively to recover from the attacks and access decryption keys. Not only does paying off cyberattackers fund their initiatives and encourage more attacks, but it also may cause cyber insurance rates to go up. Additionally, there is no guarantee that a company will receive the key in exchange for payment.
FBI Director Christopher Wray gave a statement at a June 23 hearing of the US Senate Committee on Appropriations, confirming that companies should refrain from paying ransom demands. However, when further damage to the supply chain or business operations is on the table, several major organizations have handed over millions of dollars to threat actors in 2021 alone. Many security experts are now urging the government to enforce laws that would make it illegal to pay ransoms to ransomware groups as it is already illegal to make payments to terrorist organizations. Although it is difficult to enforce these types of laws, ransomware groups would be treated similarly to terrorist organizations in this aspect and payment could lead to sanctions on the victim company.
Read More: Recent Attacks Lead to Renewed Calls for Banning Ransom Payments
