United Kingdom

Ban threatens ransom payments in case of data breaches


It may soon become illegal for companies that are victims of data breaches to pay ransom to the hackers.

Home Secretary Clare O’Neil confirmed the government was investigating whether new laws were needed to stop ransom payments following the Medibank and Optus data breaches.

While Ms. O’Neil said that while short-term successes were needed in cybersecurity reform following the massive hacks, other long-term outcomes were considered, including banning ransom payments.

It follows that the government is launching a high-tech police operation targeting the network of hackers behind the Medibank attack, which stole customers’ medical history and private information.

“The way we think about the reform job … is some quick wins, things we can do quickly, and championing the new police operation is one of them,” Ms. O’Neil told the UKTN’s Insiders on Sunday.

“There are some really big policy questions that we need to think about and discuss, and we’re going to do that in the context of the cybersecurity strategy.

“We will look into (making ransom illegal).”

Ms. O’Neil said Medibank was right not to pay the ransom demanded by the hackers, with those behind the breach threatening to release more data if the amount was not paid.

Federal police confirmed on Friday that Russian criminals were behind the attack on Australia’s largest private health insurer.

A 100-officer permanent cybercrime operation targeting hackers will be led by the Australian Federal Police and the Australian Signals Directorate.

“This is Australia standing up and hitting back,” said Ms O’Neil.

“We are not going to sit back and let our citizens be treated this way and there will be no consequences.

“We’re going to find these people offensive, hunt them down and weaken them before they can attack our country.”

The minister said the response to cyber attacks should be improved due to their number.

She said institutions like NAB received 50 million attacks per month, while the tax authorities were subject to three million per month.

“I don’t think anyone can promise that cyber attacks will go away and one of the things people need to understand is how brutal this is,” she said.

“We need to change our whole approach and our whole thinking about this new type of crime.”

Nearly 500,000 health claims were stolen along with personal information as part of the Medibank breach.

The insurer has created a one-stop shop for mental health and other support services that affected customers can reach through its website.

Ms. O’Neil said companies should ensure better data security.

“What this is for us is a national vulnerability and we need to make sure that companies keep data only for when it’s really useful and the data is thrown away in some other way,” she said.