2 min read

Does Your Municipality Plan to Pay a Ransomware Ransom? States Starting to Say “No”

Kevin Howarth, Communications Manager

When municipalities get caught off guard by a ransomware attack, they sometimes see paying the ransom as a way out. It’s not a pretty option, but it’s (supposedly) a way to get your data back in a worst-case situation.

However, cybersecurity experts and law enforcement officials have warned for years that paying a ransom is not the right decision for many reasons:

92% of impacted organizations don’t get all their data back. (Source)
29% of impacted organizations cannot get more than half their data back. (Source)
Of those organizations that pay a ransom, 80% get hit again. (Source)
Cybercriminals may still be inside your systems after you pay.
You are keeping cybercriminals in business and validating their business model.
You may be funding terrorism, sex trafficking, drug trafficking, and other illicit activities.
You are saying “Target me again!”

For those and many other reasons, municipalities should not pay a ransom. Yet, they do. To stop these payments from happening, states are seeking to deter municipalities.

North Carolina: On April 5, 2022, North Carolina passed a law prohibiting municipalities from paying a ransom related to a ransomware attack and even communicating with any cybercriminals instigating the ransomware attack.
Florida: HB 7055 (passed by the House and Senate and likely to be signed into law by Governor Ron DeSantis) also prohibits municipalities from paying a ransom.
Pennsylvania: SB 726 passed the Senate but stalled in the House. This bill prohibits using taxpayer money to pay a ransom but makes an exception if the Governor declares a disaster emergency and deems paying a ransom to be necessary in that situation.
New York: Senate Bill S6806A made it to committee in the Senate. Like the other bills, it prevents governmental entities (including municipalities) from paying a ransom related to a ransomware attack.

These are just a few examples of states that are aggressively pursuing laws, with bipartisan support, that prevent municipalities from paying ransoms. Similar to data breach notification legislation or data privacy laws, it just takes a few states to set the example before other states follow suit.

This is a good time to ask yourself, “Am I prepared for a ransomware attack without the option of paying a ransom?”

If you’re concerned about this trend and don’t like the idea of a ransom payment removed from your arsenal, consider once again the above facts and statistics while also taking the opportunity (especially with ARPA funds) to put a foundation in place that helps you deal effectively with a ransomware attack.