Get all your news in one place.
100’s of premium titles.
One app.
Start reading
Tribune News Service
Tribune News Service
National
Gopal Ratnam

US lacks full picture of ransomware attacks, Senate panel finds

WASHINGTON — The U.S. government lacks a complete picture of ransomware attacks that routinely cripple government and private sector networks, according to an investigation by Senate Homeland Security and Governmental Affairs Committee staff.

The report, released Tuesday, also found that the government lacks information on how much ransom was paid — typically in the form of cryptocurrencies — by victims of such ransomware attacks.

“Cryptocurrencies, which allow criminals to quickly extort huge sums of money, can be anonymized, and do not have consistently enforced compliance with regulations, especially for foreign-based attackers, have further enabled cybercriminals to commit disruptive ransomware attacks that threaten our national and economic security,” Sen. Gary Peters, D-Mich., chairman of the committee, said in a statement accompanying the report.

The investigation found the federal government “lacks the necessary information to deter and prevent these attacks, and to hold foreign adversaries and cybercriminals accountable for perpetrating them,” Peters said.

In 2021, ransomware attacks affected at least 2,323 local governments, schools and health care providers in the United States, according to the report.

“Many of these attacks generated significant losses and damages for victims,” the report said. Data from the FBI based on complaints from victims during 2018-2020 showed “a 65.7 percent increase in victim count and a staggering 705 percent increase in adjusted losses.”

In 2021, the FBI received 3,729 ransomware complaints, with adjusted losses totaling $49.2 million, according to the report.

But the data “drastically underestimates” the number of attacks and ransoms paid, and the FBI considers the numbers to be “artificially low,” the report said.

The real cost of such attacks could range from several hundred million dollars to as much as $10 billion, the report said.

In 2020, criminal gangs were said to have received “at least $692 million in cryptocurrency” as ransom payments, the report said, citing data from Chainalysis, a blockchain data and analysis company that tracks such payments. That compares with $152 million in ransoms paid in 2019, the report said.

Another study by anti-malware company Emsisoft counted 24,770 ransomware incidents across the United States in 2019, with estimated damages, including downtime losses, of “just under $10 billion,” the report said.

Legislation sponsored by Peters and the committee’s top Republican, Sen. Rob Portman of Ohio, became law as part of the omnibus spending bill that passed in March. It is intended to address such gaps in information.

The report recommended that federal agencies use a standard format to collect data on ransomware attacks and ransom payments “to facilitate comprehensive analysis.”

Congress should encourage public-private partnerships to “investigate the ransomware economy,” including the relationship between criminal gangs and cryptocurrency providers that facilitate ransom payments, the report said.

Congress and federal agencies should also encourage private and nonprofit entities to share information with the federal government on ransomware attacks and payments, the report said.

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.