Ransomware is big business, and the threat is growing.
Just days ago the Irish health service was crippled by what was described as possibly the most significant cybercrime attack on the Irish state in history. Patient appointments were cancelled, delays ensued and computer systems were shut down as IT experts rushed to assess the damage.
Make no mistake, ransomware’s impact goes far beyond the financial. When public organisations or large corporates are hit, citizens or customers also become victims.
The energy sector is also a target including a ransomware attack on the Colonial Pipeline, the US’s largest fuel pipeline. This caused days of shutdown that spiked petrol prices and caused widespread panic in the market. Closer to home, the Scottish Environment Protection Agency (SEPA) was hit with an attack on Christmas Eve last year that led to some 4,000 sensitive files including contracts, databases and strategy documents being published on the dark web.
Ransomware attacks infect a computer system with malicious software that encrypts or blocks access to files, rendering them inaccessible. The attackers then typically contact the victim asking them to pay a ransom in exchange for a digital key to unlock their files – something the unprepared are often forced to resort to. While this may sound like the type of thing you would see in a spy thriller on TV, worryingly they are no longer uncommon.
Cybersecurity firm Sophos estimates that some 37 per cent of organisations have been targeted in 2021, with the average cost of recovering from a ransomware attack more than doubling in the last year – hitting almost US$2 million. More concerning still, only 8 per cent of organisations that gave in to the hackers’ demands and paid the ransom managed to get back all of their data.
So what can be done in the face of such threats? As is often the case with cybersecurity, preparation is key, and there are obligations that businesses must adhere to.
Practicising good “digital hygiene” within your business is a key element of preventing such attacks – this involves ensuring all staff have been appropriately trained to use IT systems in a safe way, recognise potential phishing attempts, and understand the risks.
Another key weapon in the fight against ransomware is the regular creation of backups of all corporate data. While the task may sound tedious, a ransomware attack is only as effective as its impact on your data – if you have backed up recently, then it is much easier to get back online – it doesn’t of course resolve the fact data is out there.
Many of these steps are recognised as best practice, and do in fact, in many cases, form part of your legal obligations from a data protection perspective including compliance with the GDPR.
The Network and Information Systems Regulations 2018 (NIS Regulations) are also worth bearing in mind. These aim to achieve a high common level of digital security within the EU – and the UK government is maintaining the obligations despite Brexit.
The NIS Regulations impose duties on organisations that are identified as “operators of essential services” to manage the risks posed to the security of network and information systems on which their essential service relies; and to prevent and minimise the impact of security incidents.
There is a duty to report any incidents within 72 hours and penalties of up to £17 million for breach of the NIS Regulations.
Many oil and gas businesses, both upstream and downstream, are caught by the “essential services” definition, and must take action accordingly. But in the energy sector, any business in the supply chain needs to think about their role in supporting their client. In our experience, suppliers are a weak link in the chain that can lead to exposure and, also contractual liability. We know that breaches usually end up in fights over responsibility splits.
Never assume that you are too big, too small, or too insignificant to fall prey to a ransomware attack, and you will prove a far harder target than your would-be attackers are expecting.
Ross McKenzie is a partner with international law firm, Addleshaw Goddard based in Aberdeen. He advises clients in the energy sector on compliance with data protection laws and technology contracting. Kyle Sinclair, a trainee in AG’s Aberdeen office supporting clients in corporate and commercial work in the energy sector, contributed to the article.
Contact Ross to find out more: Ross.McKenzie@addleshawgoddard.com