CM December 2023

Ransomware can also be used to manipulate victims into
complying with demands for other criminal purposes, or
to advance personal or political agendas. Ransomware
therefore represents risks to individuals, to businesses,
and even to national security.
organisation involved in facilitating the payment (such as
a financial institution acting in its transactional capacity on
behalf of the victim) to other civil and criminal liability.
The distinction may be subtle, but it’s crucial. Civil liability
could include breaches of data protection legislation,
contractual breaches (financial institutions may have
contractual obligations with customers or business partners
that require them to maintain certain security standards and
promptly report security incidents) and regulatory breaches.
Criminal liability, such as money laundering offences, could
arise if the ransomware attack involves the receipt or transfer
of funds that are the proceeds of criminal activity. Deliberately
concealing a ransomware attack or impeding a criminal
investigation could amount to obstruction of justice. And, in
some case, failing to report a ransomware attack that affects
the financial institution's customers or ongoing operations
could result in the commission of a fraud or misrepresentation.
It should be remembered that every ransomware attack that
is hushed up – with no investigation, information-sharing or
lesson-learning – makes other attacks more likely; that as well
as the risk of civil and criminal liability, financial institutions
involved in ransomware attacks or making ransom payments
could be under a regulatory obligation to report cyberattacks;
and liability for financial services organisations can result from
ransomware even where, on the face of it, data may not (yet)
have been stolen or leaked. The NCSC and ICO recommend
that as soon as there is any intimation of a ransomware attack,
organisations should assume that data has been compromised.
Ransomware and sanctions
The UK operates a cyber sanctions regime that includes
regulations such as the Cyber (Sanctions) (EU Exit) Regulations
2020, aimed at furthering the prevention of cyberthreats like
ransomware. The regulations provide for the imposition of
asset freezing and travel bans on persons involved in relevant
cyberactivity. Other UK sanctions, known as sectoral sanctions,
can restrict and prohibit certain activities, such as the transfer
of funds to or from other jurisdictions.
continues on page 22 >
Brave | Curious | Resilient / www.cicm.com / December 2023 / PAGE 21