Joint Committee on the National Security Strategy publishes ransomware report

The Joint Committee on the National Security Strategy published its report, "A hostage to fortune: ransomware and UK national security", on 13 December 2023, stating that there is a high risk the Government will face a severe ransomware attack at any moment and that its planning will be found lacking¹. The report makes recommendations to government, which has two months to respond¹.

The committee describes ransomware as malware designed to damage and destroy computers and computer systems, usually to facilitate extortion, and says UK authorities have identified it as the number one cyber threat to the nation¹. It states that the UK is one of the most targeted countries in the world, that the majority of ransomware attacks against the UK are from Russian-speaking perpetrators, and that ransomware is now marketed as a service which can be purchased by criminal gangs¹. It adds that mass data loss from an attack can be irreversible, even when the ransom is paid, with many organisations taking months to recover¹.

The report cites a series of incidents. The WannaCry attack in 2017 affected over 200,000 computers in more than 150 countries, hit at least 34% of trusts in England and was estimated to have cost the health service around £92 million through lost services². Hackney Council's October 2020 attack disrupted services for months and cost the Council over £12 million, while Gloucester City Council faced costs of around £800,000 after malware from a Russian threat actor in December 2021 caused delays to benefits payments, property sales and planning applications². Redcar and Cleveland Borough Council's February 2020 attack kept it offline for almost a week and recovery took eight and a half months². The report also records that the number of attacks against UK victims increased by 233% between 2020 and 2021, and that the volume of ransom payments quadrupled².

The committee's recommendations include transferring responsibility for ransomware from the Home Office to the Cabinet Office, in partnership with the NCSC and NCA, overseen directly by the Deputy Prime Minister; scoping a cross-sector regulator on critical national infrastructure cyber resilience; holding regular national exercises for a major attack affecting multiple CNI sectors; funding the NCSC to establish a dedicated local authority resilience programme; funding the NCSC and NCA to support all public sector victims to the point of full recovery; establishing a central reporting mechanism for ransomware attacks; and working with the insurance sector on a re-insurance scheme for major cyber-attacks¹. It also calls for legislation to update the Computer Misuse Act, now over 30 years old, and for significantly more resources for the NCA's response, including addressing pay parity between police and NCA officers¹.

Why it matters for households

The report concerns attacks on organisations, but it sets out how disruption reaches the public. It says past attacks have caused severe disruption to core Government services including healthcare and child protection, and that a coordinated attack could take down large parts of UK critical national infrastructure and public services¹. It notes particular concern about cash-strapped sectors such as health and local government, and that supply chains have been described by the NCA as the "soft underbelly" of CNI¹. The report records that most victims currently receive next-to-no support from law enforcement or Government agencies¹. The recommendations are addressed to government; the report does not set out advice for individual households. The National Cyber Security Centre: Help for Individuals and Families page covers the NCSC's guidance for the public, and the cyber-attacks hub covers the wider subject.

What happens next

The Government has two months to respond to the report¹. The committee also recommends that the National Audit Office review the Government's implementation of the National Cyber Strategy, and that a National Security Council sub-committee oversee progress against each of the Strategy's five pillars at least twice per year¹. The report notes that on 4 December the Government confirmed its commitment to provide "up to £10 million of new funding for research on risks to the economy and our public finances"².