Dear Mary,
Which states now have statutory laws prohibiting payment of ransom following a data security breach? Are there others working on such legislation, to your knowledge?
– Dick Clarke (But Not the New Year’s Eve Guy)
July 31, 2024
Dearest Dick,
While the phrases “ransomware” and “good news” rarely find themselves in harmonious company, private businesses may find solace in the knowledge that, generally, U.S. law does not restrict private entities from paying a ransom in the unfortunate event of a ransomware attack. Alas, the same cannot be said for our public sector counterparts. Legislation in states such as North Carolina, Florida, and Tennessee imposes restrictions on public sector entities from paying a ransom, with North Carolina even forbidding any communication with the threat actor altogether. Last I heard, other states such as Arizona, New York, Pennsylvania, Illinois, Iowa, Massachusetts, and Texas have been contemplating similar and possibly even more expansive laws. Additionally, laws have been introduced at the federal level that could potentially restrict ransom payments for certain types of entities, such as financial institutions, so that is most certainly something to look out for.
For private entities, although paying the ransom is not currently prohibited, there are steps that should be taken prior to making such a payment. These include notifying law enforcement and conducting a sanctions check, among others. If these steps are satisfactorily completed, the entity may be at liberty to proceed with the payment. Additionally, the entity should consider whether any regulatory authorities, such as CISA, need to be notified once payment is made.
Yours sincerely,
— Mary
“Dear Mary,” an advice column from Troutman Pepper’s Incidents + Investigations team, will answer questions about anything and everything cyber-related — incident response, forensic investigations, responding to regulators, breach-related litigation, and much more. “Dear Mary” goes beyond the articles, podcasts, webinars, and other content we produce, as we are responding directly to our reader’s questions with concise, practical answers. Answers will be general in nature and will not contain legal advice. If you need legal advice or representation, please contact one of our attorneys directly. “Dear Mary” also can be found here on the firm’s website.