3 ms·

Patient drops request to compel hospital group to pay ransom

12 points by impish9208 3y ago

impish9208 3y ago
https://archive.is/Vt5au https://archive.is/Vt5au
Wowfunhappy 3y ago
Paying these ransoms should, in fact, be criminalized. If it was, the attacks would basically go away. Even if you assume some ransom payments would still happen under the table, the amounts would have to be drastically lower (there's a limit to how much can be hidden on a company's balance sheet) meaning much less profit for the hackers and less incentive to attack.
- detaro 3y ago
  There was an interesting question a while back what happens if a company pays a ransom to a group affiliated with some entity that's under sanctions (which isn't exactly an unlikely scenario)
vivegi 3y ago
Demanding a ransom is criminal. Paying a ransom should be a business decision. There are already many business constructs such as key man insurance, cybercrime insurance etc., that are b2b contractual agreements to protect against such losses. How does one reconcile the existence of such agreements while (potentially) outlawing this? It is horrifying to be on the receiving end of a business' data security and confidentiality mess. IANAL, but the patient should have sued under PHI disclosure by the covered entity to an unauthorized party without patient consent. This in addition to the federal HIPAA violations and state civil penalties and other legal remedies the patient is entitled to. [1] [1]: https://www.hipaajournal.com/what-is-the-maximum-penalty-for-violating-hipaa/ https://www.hipaajournal.com/what-is-the-maximum-penalty-for...
- lostlogin 3y ago
  So once you have paid the hackers, what’s to stop them doing it again, or demanding a second ransom?
  - vivegi 3y ago
    So, you would prohibit constructs like key person insurance [1] or cyber insurance [2] that have clauses for settling ransom payment claims for kidnaps or extortion after a data breach? These already exist. [1]: https://www.travelers.co.uk/iw-documents/uk/documents/kidnap-and-ransom-coverage-examples-0814.pdf https://www.travelers.co.uk/iw-documents/uk/documents/kidnap... [2]: https://www.thehartford.com/cyber-insurance https://www.thehartford.com/cyber-insurance

12 points by impish9208 3y ago

https://archive.is/Vt5au https://archive.is/Vt5au

Paying these ransoms should, in fact, be criminalized. If it was, the attacks would basically go away. Even if you assume some ransom payments would still happen under the table, the amounts would have to be drastically lower (there's a limit to how much can be hidden on a company's balance sheet) meaning much less profit for the hackers and less incentive to attack.

detaro 3y ago
There was an interesting question a while back what happens if a company pays a ransom to a group affiliated with some entity that's under sanctions (which isn't exactly an unlikely scenario)

vivegi 3y ago

Demanding a ransom is criminal. Paying a ransom should be a business decision. There are already many business constructs such as key man insurance, cybercrime insurance etc., that are b2b contractual agreements to protect against such losses. How does one reconcile the existence of such agreements while (potentially) outlawing this? It is horrifying to be on the receiving end of a business' data security and confidentiality mess. IANAL, but the patient should have sued under PHI disclosure by the covered entity to an unauthorized party without patient consent. This in addition to the federal HIPAA violations and state civil penalties and other legal remedies the patient is entitled to. [1] [1]: https://www.hipaajournal.com/what-is-the-maximum-penalty-for-violating-hipaa/ https://www.hipaajournal.com/what-is-the-maximum-penalty-for...

lostlogin 3y ago
So once you have paid the hackers, what’s to stop them doing it again, or demanding a second ransom?
- vivegi 3y ago
  So, you would prohibit constructs like key person insurance [1] or cyber insurance [2] that have clauses for settling ransom payment claims for kidnaps or extortion after a data breach? These already exist. [1]: https://www.travelers.co.uk/iw-documents/uk/documents/kidnap-and-ransom-coverage-examples-0814.pdf https://www.travelers.co.uk/iw-documents/uk/documents/kidnap... [2]: https://www.thehartford.com/cyber-insurance https://www.thehartford.com/cyber-insurance