You Knew It Would Eventually Happen: Ransomware Lawsuits

Organizations that have fallen victim to a ransomware attack are now being sued by impacted employees and customers alike who are citing loose cybersecurity was in place.

For a long time, analysts and technical evangelists have been saying that the aftermath of a cyberattack will by financially impactful. It appears that recent ransomware attacks are no exception. The recent attacks on critical infrastructure have resulted in multiple lawsuits where businesses and customers relying on victim organizations are suing for damages.

For example, we saw the pipeline attack back in February cause temporary gas shortages and rises in gas prices – this has resulted in multiple lawsuits. Scripps Health suffered a ransomware attack back in May and is already facing several class-action lawsuits.

It’s evident that those impacted by ransomware attacks are keenly aware of their ability to seek damages. The challenge is to prove that the victim organization was “cyber-negligent” in that their cybersecurity stance was lax. My question is “What is the technical security-centric litmus test for negligence?” Think about it – do these companies being sued need to simply demonstrate they put forth a reasonable effort to fend off the lawsuit? Or will the specific circumstances of each attack fall under scrutiny and, if it turns out there was **something** the organization could have done to better secure the vulnerable part of the environment, the organization will be found at fault? (We’ve seen this level of detail come into play with lawsuits between cyber insurance companies and their insured organizations that fell victim to a cyberattack.)

Only time will tell what the outcome of the lawsuits will be and what precedence will be set by them. But one thing is clear – if you want to steer clear of ransomware-related lawsuits, don’t become a victim in the first place. And that means tightening up security around three initial attack vectors I’ve mentioned time and time again: vulnerabilities (so put proper vulnerability management in place), RDP access (disable RDP and use a secure remote solution), and phishing attacks (leverage Security Awareness Training to educate employees on how to spot malicious content). If you address these three issues, ransomware should be far less of a problem.