You Knew It Would Eventually Happen: Ransomware Lawsuits

Ransomware LawsuitsOrganizations that have fallen victim to a ransomware attack are now being sued by impacted employees and customers alike who are citing loose cybersecurity was in place.

For a long time, analysts and technical evangelists have been saying that the aftermath of a cyberattack will by financially impactful. It appears that recent ransomware attacks are no exception. The recent attacks on critical infrastructure have resulted in multiple lawsuits where businesses and customers relying on victim organizations are suing for damages.

For example, we saw the pipeline attack back in February cause temporary gas shortages and rises in gas prices – this has resulted in multiple lawsuits. Scripps Health suffered a ransomware attack back in May and is already facing several class-action lawsuits.

It’s evident that those impacted by ransomware attacks are keenly aware of their ability to seek damages. The challenge is to prove that the victim organization was “cyber-negligent” in that their cybersecurity stance was lax. My question is “What is the technical security-centric litmus test for negligence?” Think about it – do these companies being sued need to simply demonstrate they put forth a reasonable effort to fend off the lawsuit? Or will the specific circumstances of each attack fall under scrutiny and, if it turns out there was **something** the organization could have done to better secure the vulnerable part of the environment, the organization will be found at fault? (We’ve seen this level of detail come into play with lawsuits between cyber insurance companies and their insured organizations that fell victim to a cyberattack.)

Only time will tell what the outcome of the lawsuits will be and what precedence will be set by them. But one thing is clear – if you want to steer clear of ransomware-related lawsuits, don’t become a victim in the first place. And that means tightening up security around three initial attack vectors I’ve mentioned time and time again: vulnerabilities (so put proper vulnerability management in place), RDP access (disable RDP and use a secure remote solution), and phishing attacks (leverage Security Awareness Training to educate employees on how to spot malicious content). If you address these three issues, ransomware should be far less of a problem.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 21 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Ransomware

Subscribe To Our Blog

Cybersecurity Awareness Month Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews