WASHINGTON, D.C. – U.S.  Senator Gary Peters (D-MI), Chairman of the Senate Homeland Security and Governmental Affairs Committee, recently released a new report detailing the results of his investigation into the role cryptocurrencies continue to play in emboldening and incentivizing cybercriminals to commit ransomware attacks that pose an increasing national security threat.

Peters’ report found that the federal government lacks sufficient data and information on ransomware attacks and the use of cryptocurrency as ransom payments in those attacks. The report’s findings highlight the importance of quickly implementing Peters’ landmark law to require critical infrastructure owners and operators to report to the Cybersecurity and Infrastructure Security Agency (CISA) within 24 hours if they make a ransomware payment and within 72 hours if they experience a substantial cybersecurity incident. Once implemented, Peters’ law will ensure the federal government is receiving much-needed information on ransomware attacks that will help protect critical infrastructure and hold attackers accountable.

Washington Post: The Government’s Still Mostly in the Dark on Ransomware

“The government is largely in the dark when it comes to the scale of ransomware attacks pummeling schools, local governments, and businesses, a congressional report out this morning warns.” 

“That paucity of data is having real impacts — making it tougher for law enforcement to investigate attacks, limiting how other agencies help victims, and making it tougher to help companies more broadly defend themselves against the most dangerous hacking threat in decades, the report finds.” 

“Government has made some progress at getting its arms around the threat. Most notably, in March Congress passed a bill requiring some companies to report to CISA when they pay a ransom to hackers. Peters sponsored the Senate version of that bill with the Homeland Security Committee’s top Republican Sen. Rob Portman (Ohio).” 

Roll Call: US Lacks Full Picture of Ransomware Attacks, Senate Panel Finds 

“The investigation found the federal government ‘lacks the necessary information to deter and prevent these attacks, and to hold foreign adversaries and cybercriminals accountable for perpetrating them,’ Peters said.” 

“In 2021, the FBI received 3,729 ransomware complaints, with adjusted losses totaling $49.2 million, according to the report. But the data ‘drastically underestimates’ the number of attacks and ransoms paid, and the FBI considers the numbers to be ‘artificially low,’ the report said.” 

“Legislation sponsored by Peters and the committee’s top Republican, Sen. Rob Portman of Ohio, became law as part of the omnibus spending bill that passed in March. It is intended to address such gaps in information.” 

The Hill: Senate Report Reveals Gaps in Data Collection on Ransomware Payments 

“The report also found that current government reporting of ransomware attacks and cryptocurrency is ‘fragmented across multiple federal agencies,’ and that the lack of reliable data limits the tools needed to secure the nation against cyber threats. The analysis also said such attacks have limited both the private sector and the federal government in assisting cybercrime victims.” 

“Lawmakers have also ramped up their efforts with the introduction of several cyber-related bills, and the passage of a new law requiring companies in critical sectors to report significant cyberattacks within 72 hours and ransomware payments within 24 hours.” 

“‘My bill that was recently signed into law to require critical infrastructure to report cyber-attacks and ransomware payments will be a significant step to ensuring our government has better data to understand the scope of this threat, disrupt the incentive virtual currencies provide for cybercriminals to commit attacks, and help victims quickly recover after breaches,’ Peters said.” 

Cyberscoop: Senate Report Criticizes Feds' Approach to Ransomware Investigations 

“The report, which focuses on the use of cryptocurrency to execute such attacks, concludes that the government is struggling to keep up with the problem in part because data reporting and collection on ransomware attacks and payments is ‘fragmented and incomplete.’” 

“Recommendations from the report include that the federal government should standardize existing federal data on ransomware incidents and ransom payments to make it easier to analyze the threat comprehensively. The report also suggests that Congress establish additional public-private partnerships to investigate ransomware while pushing everyone to share information about ransomware attacks and payments through crowdsourcing and other initiatives.” 

“‘The increased use of cryptocurrencies as the preferred method of payment in ransomware attacks shows that cybercriminals believe they can commit attacks without being held accountable,’” Peters said in a statement. ‘My investigation will help us better understand how cryptocurrency can embolden cybercriminals, and identify possible policy changes that would help disrupt the incentive cryptocurrencies provide for criminal organizations and foreign adversaries to target critical public and private sector systems.’” 

Executive Government: Sen. Gary Peters Issues Report on Use of Cryptocurrency in Ransomware Attacks 

“Sen. Gary Peters, D-Mich., chairman of the Senate Homeland Security and Governmental Affairs Committee, has released a report saying the federal government lacks sufficient information on ransomware attacks and the use of cryptocurrency in ransom payments.” 

“Implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 ‘will be a significant step to ensuring our government has better data to understand the scope of this threat, disrupt the incentive virtual currencies provide for cybercriminals to commit attacks, and help victims quickly recover after breaches,’ Peters said.” 

Cybersecurity Dive: Feds remain in the dark as ransomware disclosure lags 

“Peters in July 2021 launched an investigation into the role cryptocurrencies play in ransomware. The probe was announced after a series of devastating ransomware attacks on key industries, including the May 2021 attack on Colonial Pipeline, followed weeks later by a ransomware attack on meat supplier JBS USA and the July ransomware attack against IT monitoring firm Kaseya.” 

“‘We need to build on this landmark effort to go after criminal hackers [and] disrupt the incentive virtual currencies provide for them to commit attacks,’ Peters said in a tweet.” 

“The report’s recommendation for a public-private partnership to conduct research on the ransomware economy and develop effective countermeasures is spot-on and needed now, according to Adam Golodner, co-chair of Trusted Future, a nonprofit group focused on digital security, privacy, and related issues.”

###