Paying cyber criminals who have either infected your systems with ransomware or are attempting to extort money from you by other methods, is not a good idea. It is not illegal to pay them, or set up a business to help facilitate and negotiate these payments. Payment encourages the problem. The National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO) wrote an open letter to The Law Society and The Bar Council explaining this:
It now seems that the combination of better cyber security awareness, actions, tools and preparation in conjunction with and information such as that in the above letter is having an impact. Here is the report by Chainalysis:
Ransomware Revenue Down As More Victims Refuse to Pay – Chainalysis
The fact that a number of the organised ransomware gangs are apparently based in Russia may also be having an impact on organisation’s interest in paying up. It may also contravene international sanctions against Russia, imposed since the Russia Ukraine conflict started, making the payment and any business operations to facilitate or negotiate these payments seriously illegal.
Clive Catton MSc (Cyber Security) – by-line and other articles
