UK government launches ‘world-leading’ proposals to protect business from ransomware attacks

The UK government has set what it describes as “world-leading” proposals to better protect UK businesses from ransomware attacks.

Under the new measures, it said it would place a ban on ransomware payments for all public sector bodies and critical national infrastructure as part of an expansion of the existing ban on ransomware payments by government departments.

The government claims the move would make services such as the NHS the “most unattractive targets” for ransomware crimes.

Additionally, the government will implement a ransomware payment prevention regime designed to increase the National Crime Agency’s (NCA) awareness of live attacks and criminal ransom demands.

The measure aims to provide victims with advice and guidance before they decide how to respond and block payments to known criminal groups and sanctioned entities.

The government added that it will introduce a mandatory reporting regime for ransomware incidents, which it said would bring ransomware “out of the shadows” and maximise the intelligence used by UK law enforcement agencies to warn of emerging ransomware threats.

Carried out largely by Russian affiliated criminal gangs, ransomware attacks continue to pose the most immediate and disruptive threat to the UK’s critical national infrastructure, according to the National Cyber Security Centre’s (NCSC) Annual Review 2024. They also cause more disruption and pose a greater risk than other cybercrimes.

The NCSC managed 430 cyber incidents between September 2023 and August 2024, including 13 ransomware incidents which were deemed to be nationally significant.

Recent cyberattacks have included a key supplier to London Hospitals and Royal Mail, with the number of UK victims appearing on ransomware data leak sites doubling since 2022.

NCSC chief executive Richard Horne said that every organisation needs to ensure they are well protected against cyberattacks and urged them to use resources such as Cyber Essentials and NCSC’s Early Warning.

“Organisations across the country need to strengthen their ability to continue operations in the face of the disruption caused by successful ransomware attacks,” he added. “This isn’t just about having backups in place: organisations need to make sure they have tested plans to continue their operations in the extended absence of IT should an attack be successful, and have a tested plan to rebuild their systems from backups.”