
Locked Out: Ransomware Tightens its Grip on Canada
Overview
In August 2024, the Canadian Internet Registration Authority (“CIRA”) undertook a Cybersecurity Survey targeting cybersecurity decision makers across Canada. The study revealed that 28% of cyber professionals surveyed reported that their organization had been the victim of a successful ransomware attack in the last 12 months, where 73% of those organizations indicated that data was successfully exfiltrated by cybercriminals. Additionally, a staggering 79% of cyber security decision makers indicated that their organization paid the ransom demands of cybercriminals to restore access to their data or systems.[1] Ransomware and cyberattacks instigated by bad actors are on the rise. IBM’s “Cost of a Data Breach Report 2024” reveals that the average cost of a data breach in 2024 has increased to a staggering $4.88 million USD. This number accounts for a rise in the cost of lost business after a cyberattack and the cost of post-breach responses required by organisations to recover from a cyberattack.[2]
Since April 2021, the Canadian National Cybercrime Coordination Centre has received more than 2,000 requests for assistance from both domestic and law enforcement partners.[3] From 2021 to 2023, approximately 55% of the requests made that had a link to Canada involved ransomware.[4] Ransomware has proven to be a top threat to Canadian organizations. Not only can ransomware impact an organization’s security, data and IT infrastructure, it can cause significant recovery costs and reputational damage.
What is ransomware?
Ransomware is a cyberattack that combines the use of malicious software with extortion. It is a tactic often used by cybercriminals to exploit an individual’s or an organization’s reliance on a technology system or valuable data. There are two major types of ransomware attacks, “locker” ransomware and “crypto” ransomware. “Locker” ransomware locks the interface of an organization’s IT system whereas “crypto” ransomware encrypts data and prohibits its use without entering an encryption key held by the bad actors.
Typically, cybercriminals attack an organization’s IT infrastructure with ransomware by targeting end-user devices such as laptops, desktops and mobile devices. These attacks can block access to the infected devices and interrupt critical internal business functions, affect data stored on end user devices and, in turn, the cybercriminals often demand payment from the victim to restore access.
Organizations can mitigate against potential ransomware attacks by building out secure IT infrastructure and maintaining current backups of data and IT systems so that access can be restored from a backup without having to pay a cybercriminal’s ransom demand. For more information, please see our tips in dealing with ransomware attacks below.
I’m the victim of a ransomware attack, what next?
The decision to pay the ransom demanded by a cybercriminal in a malware attack is difficult and, ultimately, a business decision. A common trend is that organisations will often pay the ransom and remain silent on being the victim of a ransomware attack, where possible. For example, Public Safety Canada reported in 2021 that only 10% of businesses affected by cybercrime reported the incident to law enforcement, which means that the actual rate of cybercrime and incidents of ransomware are likely much higher than these statistics suggest.[5] However, where key data is breached or lost, organizations often are forced to disclose a data breach to the applicable Canadian privacy regulators and the individual’s directly affected by the attack.
Cybercriminals put undue pressure on individuals and organizations to pay their ransom demands but doing so does not guarantee the restoration of access to your devices, compromised IT systems or data. Paying ransom is often viewed as a funding mechanism for cybercriminals and does not guarantee that access will be restored. Cybercriminals are known to continue to infect IT systems and demand additional payments after the first ransom demand is fulfilled.[6]
If you do decide to pay the ransom it is critical that you contact the authorities and appropriate professionals before doing so. This includes contacting the local police, the Canadian Centre for Cybersecurity, and both your insurer and counsel. The IBM “Cost of a Data Breach Report 2024” estimates that there is an estimated USD 1 million in savings for ransomware victims when they involve law enforcement and that involving law enforcement at the start of a ransomware attack can also shorten the time required to identify and contain a cybersecurity breach.[7]
Is paying the ransom legal?
In Canada, there is no law against paying cybercriminals. However, ransom payments may be deemed illegal because doing so can be a breach of government sanctions as payment of a ransom can provide funding for terrorist activities or anti-money laundering initiatives. Further, the Canadian Criminal Code specifically prohibits participation in activity with a terrorist group where every person who knowing facilitates a terrorist activity is guilty of an indictable offence and liable to imprisonment for a term not exceeding fourteen years.[8]
The Government of Canada has announced its intention to introduce new cyber systems legislation which would establish a regulatory framework to support the improvement of cybersecurity and provide the government with a new tool to respond to emerging cyber threats. Before paying any ransom in Canada, it is best practice for organisations to first obtain legal compliance clearance reports to ensure that making payment does not violate any Canadian or international sanctions.
Similarly, in the United States, there are no express laws that prohibit a corporation or entity from paying ransom to a cyber attacker. However, similar to Canada, there is a risk that by paying ransom could result in a breach of sanctions. The U.S Department of the Treasury’s Office of Foreign Assets Control issued an advisory on October 1, 2020 to alert companies that engage with victims of ransomware attacks that they risk potential sanctions for facilitating ransomware payments. In most jurisdictions, breaching sanctions law may result in serious criminal or civil liability and come with substantial fines. Additionally, anti-money laundering laws may penalize the payment of ransomware demands from cybercriminals as it can be characterized as involvement in money laundering and supporting terrorist activities.
In October 2024, Canada and the United States, along with 37 other countries, together backed new guidance supporting organizations experiencing ransomware attacks at the Counter Ransomware Initiative. The guidance makes clear that paying a ransom only emboldens cybercriminals and instead organisations are encouraged to report attacks to law enforcement.
Practical tips for dealing with ransomware
We have outlined five practical takeaways for organizations related to ransomware attacks.
- Be Prepared. Organizations should implement cyber-incident response infrastructure prior to an incident occurring. This includes naming an incident security coordinator and an internal response team that will provide a timely, organized and effective response to a ransomware attack. Additionally, implementing a response plan should provide an organization with a structured and systematic process for all information security incidents that aims to mitigate or minimize the effects of an incident and clearly outlines the next steps the company will take in response to a cyber attack.
- Engage Professionals. Entities that are the victim of a ransomware attack should engage the requisite professionals immediately upon discovery of the incident. This includes engaging technical advisors, legal counsel, your insurers, law enforcement and someone skilled in negotiating with cyber criminals, like a digital forensic incident response team or payment facilitator.
- Investigate and Mitigate. Organizations should assess the scope of the ransomware attack immediately by identifying what data has been compromised, the risk attached to the compromised data and undertake best efforts to minimize the effects of the attack where possible through isolating the infected device and updating and repairing known bugs in the organization’s internal network.
- Notify and Comply. When subject to a ransomware attack, an organization may experience a breach of company data. In Canada, an organization may be required by law to notify individuals whose information is subject to the attack. Additionally, if an organization moves forward with paying the ransom demanded by cybercriminals, it should first investigate if any payment would violate any sanctions and verify compliance with all applicable Canadian and international law before making payment.
- Post Incident Review. Organizations are encouraged to conduct post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures that become known as the result of a cyber incident.
For assistance in dealing with a ransomware attack or mitigating the occurrence of a ransomware attack, please contact Roland Hung, a partner in the Technology and Privacy & Data Management Groups, or Laura Crimi an associate in the Technology and Privacy & Data Management Groups at Torkin Manes LLP.