New York State Regulated Entities Security Incident

June 30, 2021 To: All New York State Regulated Entities Re: Ransomware Guidance The ransomware crisis threatens every financial services company and their customers. And a major ransomware attack could cause the next great financial crisis. A ransomware attack that simultaneously cripples several financial services companies could lead to a loss of confidence in the financial system. This could happen either through an exploitation of a vulnerability in widely used software to attack many companies at once as seen recently for SolarWinds and Microsoft Exchange or through a single ransomware attack that disables critical infrastructure for financial services, such as a cloud services provider or a regional power grid. As ransomware attacks continue to grow in number, scope, and sophistication, they are fueling a sharp increase in the cost of cybercrime. Homeland Security Secretary Alejandro Mayorkas recently stated that the rate of ransomware attacks increased 300% in 2020. [1] Ransomware is costly because it is the most disruptive cybercrime. Unlike cybercrime focused on theft, ransomware sidelines organizations it shuts down hospitals, schools, and companies. It prevents consumers from getting services, patients from receiving care, and employees from working. Since mid-2020, ransomware criminals usually also steal data before deploying ransomware so that they can extort victims by threatening to publish the data so-called double extortion. As the Department of Financial Services (the Department or DFS) noted in the Cyber Insurance Risk Framework in February 2021, the cost of ransomware has also shaken up the cyber insurance market. Because of ransomware, loss ratios on cyber insurance increased from an average of 42% during 2015-2019 to 73% in 2020. [2] Increasing costs are impacting premiums and the scope of coverage. More encouragingly, rising costs are also pressuring insurers to be more rigorous in assessing the cybersecurity of their customers and...

... (truncated for display)