UK plans to ban public sector organizations from paying hackers for ransomware
UK public sector and critical infrastructure organizations could be banned from paying ransoms under new proposals from the UK government.
The UK Home Office launched a consultation on Tuesday proposing a “targeted ban” on ransomware payments. Public sector bodies including local councils, schools and NHS trusts would be banned from paying ransomware hackers under the proposals, which the government said would “attack the heart of cybercrime's business model”.
The government proposals come after a wave of cyberattacks targeting the UK public sector. Last year, the NHS declared a “serious” incident after a cyberattack on pathology lab provider Synnovis resulted in a massive breach of sensitive patient data and caused months of disruption, including canceled surgeries and diversions of emergency patients. Cyberattacks on Synnovis harmed dozens of patients, in at least two cases causing long-term or permanent damage to their health, according to new data seen by Bloomberg.
New proposals from the UK government would also make it a criminal offense for critical infrastructure organizations, such as those in the energy and communications industries, to pay ransoms in the event of a ransomware attack. UK government departments have been banned from paying ransomware gangs.
The UK proposal also details a new mandatory reporting regime for ransomware incidents, which would require victims of cyberattacks not covered by the ban to report the incident to the government. Another proposal lays out a plan to block ransom payments to sanctioned entities, which the government would have the power to block.
Security Minister Dan Jarvis said: “With $1 billion expected to be lost to ransomware criminals globally by 2023, we must take action to protect national security as key to this government’s plan for change Base.
“These proposals help us address the scale of the ransomware threat, hitting the wallets of these criminal networks and cutting off the critical financial channels they rely on to operate,” Jarvis said.
The UK's National Cyber Security Center managed 430 cyber incidents in the year to August 2024, including 13 ransomware incidents of “national significance”, according to figures shared by the Home Office on Tuesday. The Home Office said the attacks were carried out “primarily by Russian-linked criminal gangs” who continued to pose a “direct and damaging threat” to the UK's critical national infrastructure.
The UK's National Crime Agency took action against one of the gangs in October 2024, uncovering an alleged affiliate of the Russia-linked LockBit ransomware group. LockBit has been linked to previous cyber attacks against NHS IT supplier Advanced.
Britain did not say whether it planned to put the measure to members of parliament for consideration. The Home Office consultation will end in April 2025.
In the United States, the federal government has long urged against paying ransoms but has stopped short of enacting a nationwide ban on ransom payments. However, in October 2023, a coalition of more than 40 countries led by the United States vowed that governments would not pay ransoms to cybercriminals in order to cut off hackers' sources of income.