The ransomware business is booming in Canada.
Recent victims have included large corporations such as retailer London Drugs, as well as the City of Hamilton, Ont., and the government of Newfoundland and Labrador.
But the criminals who sometimes brag of their attacks on the so-called dark web don香蕉视频直播檛 seem fussy about their targets, based on a small sample of the targets listed by B.C.-based threat analyst Brett Callow. Among them have been a B.C. library network, the province香蕉视频直播檚 First Nations Health Authority and an Ontario charity for disabled children.
Cybersecurity experts say the spate of attacks has serious implications for victims and the public, and organizations need multi-layered protection in a landscape of fledgling online security standards.
Callow favours an outright ban on ransom payments, or at least regulations limiting them, to stem the tide of attacks.
Toronto-based lawyer Eric Charleston says it香蕉视频直播檚 not so simple, and he香蕉视频直播檚 seen cases where a ban would have meant 香蕉视频直播渁 punishment of the victims.香蕉视频直播�
But both agree that potential targets should boost security to prevent breaches from happening at all.
Charleston said many incidents go unreported, so it香蕉视频直播檚 hard to exactly gauge the apparent increase in ransom cyberattacks, in which hackers demand payment or they will release sensitive data.
However, the advent of cryptocurrency has given cybercriminals who often operate in foreign jurisdictions a way to monetize data theft, he said.
香蕉视频直播淭he fact that all these transactions are recorded on the blockchain (means) the breadcrumbs are there on where this money is going,香蕉视频直播� he said.
香蕉视频直播淏ut at the end of the day, if you have different regulations on how people can divest from their crypto accounts 香蕉视频直播� (they) can still come in and take the money.香蕉视频直播�
The potential implications of a data breach are far-reaching,said Charleston, the national co-leader for cybersecurity with Borden Ladner Gervais LLP.
They range from financial and reputational damage to possible legal liability amid 香蕉视频直播渆merging香蕉视频直播� standards for cybersecurity in Canada, he said. Charleston said proposed new federal and Ontario laws could herald minimum levels of security for certain sectors.
Targeted companies can face class-action lawsuits over data breaches 香蕉视频直播� last month, victims of a 2019 breach at LifeLabs Inc. started receiving payments of $7.86 each. That doesn香蕉视频直播檛 sound like much, but the total settlement amounted to $9.8 million.
Callow, meanwhile, said the stakes could be life or death. He pointed to work by researchers at the University of Minnesota School of Public Health, who estimated that ransomware attacks that disrupted hospital operations killed at least 42 U.S. Medicare patients between 2016 and 2021.
GAME OF 香蕉视频直播榃HACK-A-MOLE香蕉视频直播�
There have been some wins for law enforcement, Charleston said.
In February, the National Crime Agency of the United Kingdom led a consortium of police agencies in disrupting the operations of LockBit, calling it 香蕉视频直播渢he world香蕉视频直播檚 most harmful cybercrime group.香蕉视频直播� A subsequent statement last month identified a man from Russia as the 香蕉视频直播渁dministrator and developer香蕉视频直播� of LockBit, which provides a global network of hackers with the tools they need to carry out attacks.
Callow, who works for New Zealand-based antivirus software company Emsisoft, said enforcement such as the operation against LockBit undermined confidence among cybercriminals.
But LockBit was soon up and running on a new site, he said.
Callow said LockBithad made the ransom demand over the London Drugs hack that was detected in late April and forced the B.C.-based retailer to shut all its stores across Western Canada for about a week.
The company later confirmed that data that 香蕉视频直播渕ay contain some employee information香蕉视频直播� was released, saying it was 香蕉视频直播渦nwilling and unable香蕉视频直播� to pay a ransom to hackers it described as 香蕉视频直播渁 sophisticated group of global cybercriminals.香蕉视频直播�
Callow said the good news for individual employees is that typically, nothing further happens with their stolen data. 香蕉视频直播淚t just sits there on the dark web,香蕉视频直播� he said.
He likened catching international cybercriminals who hope for a big payday from companies or institutions to a game of 香蕉视频直播渨hack-a-mole.香蕉视频直播�
香蕉视频直播淭he faster you can whack them, the less damage they can do.香蕉视频直播�
But cybercriminals seeking ransoms aren香蕉视频直播檛 the only threat.
B.C. officials have said a 香蕉视频直播渟tate or state-sponsored香蕉视频直播� actor was likely responsible for a series of attacks against the province detected in April. On Monday, Public Safety Minister Mike Farnworth said 22 government email inboxes containing the sensitive personal information of 19 employees may have been accessed during the breach.
Canadian government officials including Public Safety Minister Dominic LeBlanc issued a joint statement on Monday aimed at raising awareness of the threat 香蕉视频直播減osed by malicious cyber activity by foreign states and their affiliates.香蕉视频直播�
Certain foreign states were conducting 香蕉视频直播渨ide-ranging and long-term campaigns香蕉视频直播� to compromise Canadian government and private-sector computer systems, the statement said, singling out China, Russia, Iran and North Korea.
On Tuesday, Canada香蕉视频直播檚 auditor general released the results of a cybersecurity audit, finding the federal government lacked the capacity or tools to effectively combat increasingly sophisticated cyberattacks.
It香蕉视频直播檚 against this backdrop that Ottawa is expected to launch a new national cybersecurity strategy this year, following the creation of the National Cybercrime Coordination Centre in 2020.
A proposed cybersecurity bill is also making its way through the federal legislative process. If passed, it would provide a framework for the protection of online systems vital to national security or public safety, including empowering officials to require certain service providers to implement cybersecurity programs.
Charleston said that bill and another in Ontario showed that parameters for cybersecurity controls were being drawn in Canada.
Ontario香蕉视频直播檚 proposed legislationwas aimed at enhancing cybersecurity for public-sector institutions governed by existing privacy and freedom of information laws.
The emerging standards would likely grow into a 香蕉视频直播渞oad map香蕉视频直播� for arguments related to liability and negligence in the aftermath of cyberattacks, Charleston said.
香蕉视频直播淚t香蕉视频直播檚 less likely, I think, that the courts are going to get into what meets the standard of adequate data security and cybersecurity controls 香蕉视频直播� until some of this guidance comes along from government,香蕉视频直播� he added.
Callow said cybersecurity should be subject to standards similar to the way other sectors are regulated, such as aviation and automotive manufacturing.
But he went further in calling for an outright ban on ransom payments. Callow pointed to a recent media report suggesting U.K. officials were expected to launch public consultation on proposals to either ban such payments or require victims to report a breach to the government, then seek a licence before making any payment.
香蕉视频直播淎ll of those things would not only cut down on the payments, but also help us get a better handle on how many attacks there are, whether things are trending the right way or the wrong way, whether policies, strategies, are actually working,香蕉视频直播� he said.
Charleston took a different tack, saying he had seen cybercriminals block access to a system belonging to a company that would likely never have been able to recover its data and resume operations if it had been barred from paying the ransom.
Callow acknowledged that he was among a 香蕉视频直播渕inority香蕉视频直播� in cybersecurity who supported a ban on ransoms.
Both experts said some threats with the potential for serious consequences could be prevented through basic security measures, though they emphasized the importance of multi-layered security constantly monitoring for abnormal activity.
Charleston said organizations were constantly updating their systems, giving hackers 香蕉视频直播渇resh landscapes香蕉视频直播漷o exploit.
香蕉视频直播淭he way that the bad guys are getting in is constantly changing, and the battlefield is constantly shifting for cybersecurity professionals to keep these organizations safe.香蕉视频直播�
READ ALSO:
READ ALSO:
