UK to lead crackdown on cyber criminals with ransomware measures

Measures to tackle the threat of ransomware and protect businesses and critical services will be taken forward with industry following public consultation.

Hospitals, businesses, and critical services are set to be protected under measures designed to crack down on cyber criminals and safeguard the public, following public consultation on ransomware proposals.

Ransomware is software used maliciously by cyber criminals to access victims’ computer systems. Systems and data can be encrypted, or data stolen, until a ransom is paid. Ransomware is estimated to cost the UK economy millions of pounds each year, with recent high-profile ransomware attacks highlighting the severe operational, financial, and even life-threatening risks. 

Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measure, with nearly three quarters of consultation respondents showing support for the proposal.

The ban would target the business model that fuels cyber criminals’ activities and makes the vital services the public rely on a less attractive target for ransomware groups.    

Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom. The government could then provide those businesses with advice and support, including notifying them if any such payment would risk breaking the law by sending money to sanctioned cyber criminal groups, many of whom are based in Russia.  

Mandatory reporting is also being developed, which would equip law enforcement with essential intelligence to hunt down perpetrators and disrupt their activities, allowing for better support for victims. Consultation responses showed strong support for a new mandatory reporting regime to better protect British organisations and industry.