"Senate Report: US Government Lacks Comprehensive Data on Ransomware"

According to a new report by the United States Senate Committee on Homeland Security & Governmental Affairs, the US government lacks comprehensive data on ransomware attacks, including how much is lost in payments.  The report presented the findings of a 10-month investigation into the growing threat of ransomware.  It cited FBI figures showing that the agency had received 3729 ransomware complaints with adjusted losses of more than $49.2m.  However, it was stated that even these figures "likely drastically underestimate the actual number of attacks and ransom payments made by victims and related losses." Following numerous interviews with federal law enforcement and regulatory agencies, in addition to private companies that assist ransomware victims with extortion demands, the report concluded that there is a lack of data on this surging attack vector at the government level.  It was noted that changing this is vital because "more data is needed to better understand and combat these attacks." In addition, it noted that this information will assist the investigation and prosecution of ransomware threat actors.  The committee also emphasized the significant threat ransomware poses to US national security.  According to the committee's report, the committee stated that data reporting and collection on ransomware attacks and payments is fragmented and incomplete.  This is partly due to two separate federal agencies, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, hosting different websites that each claim to host the government's one-stop location for reporting ransomware attacks.  While the agencies state they share data with each other, companies that handle ransomware incident responses questioned the effectiveness of such communication channels' impact on assisting victims of an attack.  The investigation also highlighted the growing role of cryptocurrencies, particularly Bitcoin, in ransomware attacks, which "has become a near-universal form of ransom payment." The committee noted that the decentralized nature of these currencies makes it challenging for law enforcement to identify and arrest the perpetrators, particularly foreign-based groups.  Therefore, the committee recommended the prioritization of data collection on ransomware attacks as a crucial means of addressing increased national security threats. 

Infosecurity reports: "Senate Report: US Government Lacks Comprehensive Data on Ransomware"