Ransomware group published your data: what to do

Is the claim true?

A name on a ransomware group’s website is a claim, made by the group. It can be wrong, old or overstated. Check it in this order.

1. Your own logs. Ask your IT team or provider what they show around the date of the claim: unusual access, large transfers, new accounts.
2. Your incident-response contact. Call the firm or provider that handles incidents for you. In France, Cybermalveillance.gouv.fr is the national platform that helps victims (page in French).
3. The files themselves. Search for them as the next section explains.

Do not open the group’s website from a company machine, and do not write to the group to “see a sample” or to negotiate. ENISA, the EU cybersecurity agency, says negotiating is not recommended, and that contacting the competent cybersecurity authority or law enforcement is the recommended approach (ENISA, 2022).

What exactly was published?

Search your company name, then your domain, in the free search. It shows how many documents match and what kind they are, with names hidden, not the documents themselves. How it works.

Access is a subscription for your company. It shows excerpts of the records about your own domain as they are, keeps other companies’ names hidden, and connects your own AI assistant to the same data. What Access gives you.

A search with no result is not proof that nothing was published. The index holds what was published on ransomware sites and forums, not everything that exists, and a group can publish in several parts. Search again in a week or two.

Whom must you tell, and when?

This is general information, not legal advice. Ask your data protection officer or a lawyer how it applies to you. Deadlines run from the moment you become aware of the incident: write it down.

• GDPR, the authority. If personal data is involved and you are the controller, the GDPR sets that you notify the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33). You document the breach even when you do not notify. In France the authority is the CNIL, which says that when in doubt you notify it (page in French).
• GDPR, the people concerned. When the breach is likely to result in a high risk to them, you also tell the people concerned without undue delay, in clear and plain language (Article 34).
• NIS2. If you are an essential or important entity in scope, the directive has Member States ensure that you notify your CSIRT or competent authority of a significant incident: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report within one month after that (Article 23). The detail is in your national law. NIS2 on OwlyScan.
• DORA. If you are a financial entity in scope, you report major ICT-related incidents to your competent authority and, when one affects your clients’ financial interests, inform them without undue delay (Article 19). DORA on OwlyScan.
• Your insurer and your contracts. Tell your insurer. In France, the Code des assurances makes payment under a clause that covers losses from an attack on an automated data processing system subject to a complaint filed no later than 72 hours after the victim becomes aware of the attack. It applies to legal entities and professionals (Article L12-10-1, in French). Read your contracts for notification clauses.

Should you pay to have the data removed?

The authorities advise against paying. In France, ANSSI, the national cybersecurity agency, and the Ministry of Justice’s criminal affairs directorate recommend never paying a ransom: it does not guarantee a way to decrypt, and it encourages the criminals (ANSSI guide, in French). On the data itself, Cybermalveillance.gouv.fr says you cannot be sure it will not be made public or used fraudulently (page in French).

A promise to delete comes from the people who took the files, and you cannot check it. Even if they delete their copy, you cannot know whether anyone else has already copied the files.

What do you tell customers and partners?

Tell them early and stick to facts. A short message is enough: what happened and when you learned of it, which kinds of documents may be concerned, what you are doing, and when the next update comes. Do not guess, and do not repeat the group’s claims beyond what you have checked.

Their names may also be in your files. Point them to the guide written for them: Your supplier was hit by ransomware: what to do.

What comes next?

Groups can publish in several parts and put files online again: keep searching. Once things are calm, write down what happened and how the attackers got in.

Incident watch is an optional add-on of Access. If your company is hit by ransomware, analysts send you a dated statement of what was published about you and watch where it reappears. It is a service, not insurance, and a waiting period applies after you add it. How Incident watch works.

File a complaint. In France, Cybermalveillance.gouv.fr says to file it with the police or the gendarmerie, or by writing to the public prosecutor, before the affected devices are reinstalled, so that the technical evidence is kept (page in French). The CNIL also advises one when a notified breach follows a cyberattack.

A short checklist

1. Write down when you became aware of the claim.
2. Call your incident-response contact. Do not open the group’s site or write to the group.
3. Search your company name and your domain, note the day, and search again in a week or two.
4. With your data protection officer, check whether personal data is involved, whether NIS2 or DORA applies, and what you must notify.
5. Do not pay. Tell your insurer and file a complaint, in France before reinstalling devices.
6. Tell customers and partners the facts, with a date for the next update.

Questions people ask