There is no doubt that companies face unprecedented volume and variation in both disruptive and intrusive cyberattacks on their networks. Among the different attack methodologies today, ransomware is quickly becoming a major concern for CISOs and security professionals. According to
Interagency Guidance from the U.S. Government, there are currently over 4,000 daily ransomware attacks – up over 300% from the 1,000 daily ransomware attacks experienced in 2015.
Ransomware can potentially hold hostage critical corporate, customer and employee data, but in-house legal and communications teams are also concerned about whether these attacks trigger notification rules. The Department of Health and Human Services Office of Civil Rights ("HHS OCR"), which enforces the HIPAA Security and Breach Notification Rules, stated in
recently issued guidance that ransomware incidents may be considered a breach that require notification. The guidance is a poignant reminder to all companies, whether regulated by HIPAA or not, to carefully consider how evolving attack methodologies can directly implicate incident response strategies and compliance obligations.
What is ransomware?
Ransomware is computer code (malware) that is typically deployed into a network, often when an unsuspecting user clicks on a malicious link or opens a file in a phishing email. Once inside the network, ransomware typically self-proliferates and encrypts data inside the environment, and renders the data inaccessible and essentially, useless. A successful ransomware attack can result in the temporary or permanent loss of sensitive information, serious disruption to operations, financial costs of restoring systems and data, and possible reputational or brand impact to the enterprise.
Generally, the attacker will provide a decryption "key" only after the company pays a ransom (almost always in hard-to-trace Bitcoins). Other forms of ransomware can destroy or delete data, hide data by relocating it within the network, or even ex-filtrate data outside of the company's environment.
Myriad security software vendors offer ransomware mitigation and decryption tools. However, some recent sophisticated ransomware – such as the recently observed
"Locky" malware variant – is not easily mitigated or decrypted. The only remedy in that situation is to restore affected databases from back-up tapes (if they exist!). Paying the ransom may or may not result in the attacker providing a working decryption key.
OCR says ransomware can trigger HIPPA Breach Notification Rule
HHS OCR's
recent guidance warns HIPAA-regulated entities that application of the HIPAA Breach Notification Rule is a "fact specific" inquiry. A breach under HIPPA is defined as "the acquisition, access, use of disclosure of PHI in a manner not permitted under the [HIPAA Privacy Rule] which compromises the security or privacy of the PHI." 45 C.F.C. 162.402. HHS OCR states that where PHI is "encrypted as the result of a ransomware attack, a breach has occurred because the PHI encrypted by the ransomware was acquired (i.e., unauthorized individuals have taken possession or control of the information), and thus is a 'disclosure not permitted under the HIPAA Privacy Rule." It does not address "access" in the context of ransomware.
However, as HHS OCR points out, notification may not be required if the entity can demonstrate a "low probability that the PHI has been compromised," which turns on several factors identified in 45 C.F.R. 164.402(2):
- the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;
- the unauthorized person who used the PHI or to whom the disclosure was made;
- whether the PHI was actually acquired or viewed; and
- the extent to which the risk to the PHI has been mitigated.
The guidance goes on to explain, for example, that the lack of attempted or actual data ex-filtration, mitigation based on disaster recovery and data backups, and the entity's use by the organization appropriate level of encryption to protect the information prior to the ransomware attack (such that the data is not "unsecured PHI" under the rules), among other factors, may negate the requirement to notify affected individuals.
That said, the guidance is clear that covered entities and business associates must be highly diligent in their forensic analyses to take advantage of the notification exception. As HHS OCR remarks, "[t]he risk assessment to determine whether there is a low probability of compromise of the PHI must be thorough, completed in good faith and reach conclusions that are reasonable given the circumstances" and the entity must maintain specific and strong "supporting documentation" as required under the rules.
Does ransomware trigger U.S. State breach notification rules?
U.S. state breach notification rules are generally triggered on an unauthorized "acquisition" and/or "access" to certain delineated types of unencrypted personal information. Ransomware that only encrypts data inside an environment, but does
not allow an attacker to view, copy, re-locate, or ex-filtrate it (e.g., download, email, transfer) is unlikely to trigger a notification duty under the statutes that define breach as the "unlawful and unauthorized acquisition" of personal data.
For example,
Vermont's law includes factors to consider in determining whether personal information has been acquired by an unauthorized person
[1]. The law provides that the following "indications" may be considered:
- information "is in the physical possession and control of a person without valid authorization" such as a lost or stolen computer or other device containing information;
- information "has been downloaded or copied";
- information "was used by an unauthorized person, such as fraudulent accounts opened or instances of identity theft reported"; and
- information "has been made public, such as posting on a website."
Based on these factors, typical ransomware incidents that do not show evidence of download or exfiltration may not qualify as an "acquisition" by the attacker, subject to notification obligations.
However, a small number of states
[2], as well as the HIPAA Security Rule itself, define a breach as the "unauthorized
access" to personal information, a lower threshold than unauthorized
acquisition. Ransomware could trigger breach notice in the "access" states even if it does not trigger notice in the "acquisition" states, incidentally leaving organizations with a difficult business decision on whom to notify and in what form
There are additional factors a company and its counsel may need to consider. For example, if the data was encrypted by the data owner before it was encrypted by the ransomware attacker, in many states there would be no notification obligation. Moreover, many states permit a risk-of-harm analysis, and/or define breaches as only those incidents which "compromise the security, confidentiality, or integrity" of the personal information. Whether a ransomware attack is a notification-triggering event will always require a fact-specific analysis, based on a careful and complete investigation (sometimes by outside forensic experts) of the underlying circumstances of the attack.
What should companies do?
Given the sharp uptick in ransomware attacks and escalating legal scrutiny on
breach notification decisions, companies are well advised to re-examine and update their policies and plans, and of course, to tabletop them in simulated tests:
- Incorporate additional forensic analyses, PR/communications work streams and notification considerations into enterprise incident response plans (and/or security team field guides) to specifically address ransomware. These considerations should be based on the various factors that HHS OCR and other regulators have recommended to assess whether a ransomware attack constitutes a reportable incident, such as: (1) examining the nature and extent of personal information involved, including the sensitivity of the information and likelihood that it will be accessed; (2) whether the personal information was actually viewed, accessed, acquired or ex-filtrated; and (3) the extent to which the risk to the personal information has been mitigated.
- Update critical data backups and supplement them as necessary. This can be done as part of internal processes to integrate disaster recovery and business continuity planning with incident response programs. As noted above, ransomware attackers may or may not provide working decryption keys upon being paid, so maintaining robust back-ups will help to mitigate business disruption.
- Re-assess proactive encryption at-rest strategies. In the event of a ransomware attack or other security incident, the use of encryption may better position the company to invoke an exception to breach notification requirements. The U.S. Computer Emergency Readiness Team ("US-CERT") has published a series of helpful proactive measure that companies should consider to help manage ransomware risk.
[1] California issued guidance similar to Vermont's law in 2012. While this guidance predates recent amendments to the California state breach notification, it remains helpful to a breach notification analysis.
[2] For example, states like Connecticut, Florida, Kansas, Louisiana, and New Jersey include unauthorized access to data as a breach.