Ransomware attacks are increasing at an unprecedented rate — and the US is now begging people not to pay ransoms

hilW

• Ransomware attacks — in which hackers take over an organizations' computer systems and demand ransom payments to return them — have reached an unprecedented new high.
• The attacks have proliferated under COVID-19, when more businesses than ever are relying on online systems to function. Experts say the only way to stop the pattern is to cease paying ransoms.
• The US Treasury issued new guidance this month urging people not to pay hackers, and noting that businesses could face civil penalties if they pay ransoms to hacker groups affiliated with sanctioned nation-states.
• But some cybersecurity experts think governments should go further by passing an outright ban on paying ransoms to hackers.

The COVID-19 pandemic has shunted business across the globe online — and the transition has created countless new money-making opportunities for cybercriminals.

Ransomware attacks — in which hackers take over an organizations' computer systems and demand ransom payments to return them — have been on the rise for years and reached a new high amid the pandemic.

But cybersecurity experts and government officials are urging people to stop paying ransoms to hackers, arguing it's the only way to end the cycle.

"If the flow of cash stops, the attacks will stop," Brett Callow, a threat analyst with cybersecurity firm Emsisoft, told Business Insider.

The US Treasury issued new guidance this month warning that victims of ransomware attacks could themselves face civil penalties if they pay ransom to hackers affiliated with a sanctioned nation state. Countries including North Korea have previously been linked to ransomware attacks.

Ransomware hackers often target local government agencies and hospitals, hoping that the organizations will feel pressured to pay ransoms in order to keep providing services to constituents or patients.

Last week, a hack that bore signs of a ransomware attack debilitated the computer systems of one of the largest hospital chains in the US, taking computer systems offline and delaying procedures at more than 250 hospitals. The hospital chain, Universal Health Systems, is still attempting to restore its systems.

"Hospital systems are mission critical, and with many lives at stake, healthcare organizations become more likely to pay a ransom to swiftly get back up and running," said Torsten George, a cybersecurity analyst at Centrify.

Local government agencies have also been heavily-hit by ransomware. At least 67 US government bodies have suffered ransomware attacks in 2020 alone, at a rate of one to two agencies falling victim to ransomware attacks per week, according to an Emsisoft tally.

While the new Treasury guidance could help stave off some ransom payments to hackers, cybersecurity experts are calling for broader legislation that would make it illegal to pay ransoms, thereby undercutting hackers' revenue. Ciaran Martin, the former head of the UK's National Cyber Security Center, called for similar legislation in the UK last month.

"Ransomware attacks happen for one reason, and one reason only: they're profitable," Callow told Business Insider. "The only way way to stop them is to make them unprofitable, and that means organizations must stop paying ransoms."