When one considers the UK Parliamentary report from December 2023 and the response published on the 11th March 2024 ( Should one be surprised that…

← Back to Blog

When one considers the UK Parliamentary report from December 2023 and the response published on the 11th March 2024 (https://lnkd.in/eQ5kTkHM). Should one be surprised that the British Authorities have never detected a breach of ransomware sanctions?

The December report makes clear that there are no requirements to inform UK authorities of a cyberattack and while the UK sanction regime prohibits victims from making any extortion payments. One has to ask how organisations that go through a cyber attack and may pay a ransom, are not challenged under the UK sanctions regime? Or as the December 2023 report suggests we do not, and are not required to report cyber incidents in the UK.

In a statement the UK’s National Crime Agency (NCA), told Recorded Future News his organization “assessed that sanctions have hampered the ability of cyber threat actors to monetize their cyber criminal activities.” But, more significantly, Lyne added that the agency’s use of sanctions also “contributed to sowing discord within certain groups.”

One wonders when one considers the U.S Department of Treasuries advisory on ransomware payments and OFAC. The potential fines and prison sentence for non compliance, yet cyber attacks and ransoms still continue unabated. Ransom payments are made and sanctions appear to have little effect on slowing ransomware attacks down in the U.S (Possibly a $22mn ransom payment by UnitedHealth). If the UK should support the U.S?

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC

#cybersecurity #cyberriskmanagement #ransomware #cyberattack

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7173259383823405056