4 ms·
> If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoper
by richwater 5y ago
> If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoperable - and messages you with screenshots of all the sensitive documents and PII they'll release if you don't pay, it's hard to just release a PSA telling people to ignore it.
If a company is this incompetent once, it will happen again. Paying a ransom is just giving the company the opportunity to cover it up and collect more PII without punishment or oversight.
- meowface 5y agoThey should indeed be required to report such incidents. But banning the paying of ransoms is also foolhardy, I think, even though the US has now officially declared that paying ransoms is illegal. They're hoping to game-theoretically reduce ransomware attacks with this policy, but I'm not sure if it'll work. (It might be working to an extent, though, because in the interview I reference in https://news.ycombinator.com/item?id=27097061 https://news.ycombinator.com/item?id=27097061, the ransomware operator says he's concerned about this policy.)
- anigbrowl 5y agoI think the prohibition is on facilitating payment of the ransom (eg to a previously sanctioned individual or organization). So what we could see is a situation where Alice kidnaps Bob and tells Carol to pay a ransom; Carol attempts to do so but when she goes to withdraw money from her bank account Dave, her banker, puts a hold on the transaction or even freezes her account if the fact of Bob's kidnapping is widely known. Bob doesn't make it but Eve, Frank, and Gary tell Carol that his life is a small price to pay for standing up to Alice's terrorism.