It’s the message a CEO never wants to receive: “We’ve got your data and you need to pay up if you want it back.”
Unfortunately, that message is landing in CEO inboxes increasingly often, as ransomware attacks ramp up in the U.S. In just the first six months of 2021, the Financial Crimes Enforcement Network identified $590 million in ransomware-related Suspicious Activity Reports – a 42% increase from the 2020 total of $416 million. And FinCEN reports that we could be on track to see a higher transaction value for ransomware-related SARs than we’ve seen in the past 10 years combined.
Ransomware attacks – which use malware to encrypt files on a computer or mobile device and render it unusable until a ransom is paid – present companies with an unsavory dilemma: pay a ransom to a criminal actor, or lose a potentially devastating amount of data, which could seriously compromise business operations.
These kinds of attacks are evolving quickly in sophistication and scope, and virtually any business could be targeted at any time. What’s perhaps most concerning is that criminal actors are increasingly targeting critical infrastructure entities, as we saw in the Colonial Pipeline incident earlier this year that caused a shutdown of a major East Coast oil provider. They’ve also begun branching out into “extortion-ware,” in which the hacker not only encrypts sensitive data but then goes the extra step and threatens publicly to release it unless the institution complies with their demands.
Given the potential operational and reputational consequences of these types of cyberattacks, banks need to have a plan in advance for how they’ll respond. There are a number of factors to consider.
First, while most companies choose to pay – cyber insurer Marsh McLennan reports that more than 60% of ransomware victims pay the requested ransom – it’s not always guaranteed that the encrypted data will be fully restored. In fact, one survey of more than 5,000 I.T. decision-makers worldwide found that about half of those who did pay a ransom only recovered 65% of their compromised data. Twenty-nine percent said they only recouped about 50%.
And even if a company’s ransom hacker unlocks all the encrypted data after the ransom is paid, the company will still need to take steps to clean that data and ensure it can’t be easily re-encrypted.
On the other hand, there are also several good reasons not to pay a ransom. There are the societal costs to consider – paying the ransom could perpetrate attacks on other institutions or entice the hacker to hit you again for more money. Paying a ransom could also erode trust from customers and business partners, as payment could signal a lack of continuity planning and preparation.
ABA in October released a new Ransomware Toolkit, which provides helpful guides for protecting your bank against ransomware attacks, responding in the event of an attack, and determining whether to pay a ransom.
Either way, the first time you think about ransomware attacks and how to handle them should not be after your bank has fallen victim to one. To that end, ABA in October released a new Ransomware Toolkit, which provides helpful guides for protecting your bank against ransomware attacks, responding in the event of an attack, and determining whether to pay a ransom. The toolkit can be downloaded at aba.com/ransomware.
Ransomware represents a serious threat to all businesses. But the good news is that the financial sector is ahead of the game when it comes to cybersecurity, given the rigorous regulatory framework to which banks adhere. After all, as we found in a recent ABA/Morning Consult poll, consumers overwhelmingly trust banks the most to keep their personal information safe and secure.
By addressing the problem of ransomware head-on and taking prudent steps to prepare, we can help our industry maintain its reputation as the “gold standard” for data protection.
Rob Nichols is the president and CEO of the American Bankers Association, which represents banks of all sizes and charters and is the voice for the nation’s $20 trillion banking industry. Rob joined ABA in August 2015 following ten years at the helm of the Financial Services Forum, a non-partisan financial and economic policy organization. Before joining the Forum, Rob served in the George W. Bush administration as the assistant secretary for public affairs at the Treasury Department, a position requiring confirmation by the United States Senate. Contact American Bankers Association at 1-800-226-5377 or support@aba.com. Or email Rob at nichols@aba.com.
