A spokesperson for the regulator said its work increasing the “awareness of the link between cyber attacks and personal data breaches” was “driving organisations to improve their practices,” but the growing number of reported attacks affecting millions of people in Britain does not suggest practices are improving. As ransomware data breaches reach record high levels across the United Kingdom, the number of incidents being investigated by the country’s data protection regulator is dwindling to record lows, raising questions about its capacity and approach to the problem. That proposed major overhaul of how the country responds to ransomware attacks would have required all ransomware victims to report incidents to the government, and then obliged those victims to seek a license from sanctions authorities before making any extortion payments. Alongside the ICO’s duties, the significant increase in ransomware attacks since the publication of the National Cyber Strategy in 2022 brings into question whether the government is effectively protecting organizations and individuals in Britain. For cyber incidents, this triage process involves considering the breach’s impact on the confidentiality, integrity and availability of personal data and the risks to the public. The legislation as described falls short of more ambitious plans that were to be proposed in a Home Office public consultation, as reported by Recorded Future News, before the consultation was ultimately scuppered by Rishi Sunak’s snap election. Those numbers stand in contrast to data published for 2019 and 2020, when the privacy watchdog investigated more than 99% of the 605 ransomware incidents, probing all but three cases. Part of the role of the ICO is to enforce British data protection laws, which require organizations to protect people’s personal information using reasonable security measures. The British government has pledged to introduce a new Cyber Security and Resilience Bill to parliament next year to address the growing disruption caused by cyberattacks. Of the 1,253 incidents reported to the Information Commissioner’s Office (ICO) last year, only 87 were investigated — fewer than 7% — and just 19 of the 440 incidents reported in the first half of this year have been subjected to an investigation, fewer than 5%.
This Cyber News was published on therecord.media. Publication date: Thu, 03 Oct 2024 12:20:22 +0000