On 22 July, the UK government unveiled a set of measures designed to curb ransomware attacks and protect critical public and private sector services. Following public consultation, these steps aim to dismantle the business model of cyber criminals while fortifying national resilience against cyber threats.

Ransomware, a form of malicious software, is used by cyber criminals to encrypt victims’ systems or steal data, only unlocking access upon payment of a ransom. This cybercrime costs the UK economy millions of pounds annually, with recent high-profile attacks demonstrating risks ranging from operational disruption to life-threatening consequences.

Key Proposals

1. Targeted ban on ransomware payments: aimed at public sector bodies, including local government and critical national infrastructure (CNI) operators, this ban intends to eliminate the financial motivation for ransomware attacks on essential services. Nearly 72% of respondents supported this targeted ban, with many agreeing it would reduce funds flowing to criminals and dissuade attacks. However, concerns about implementation, the need for clear guidance, and potential exemptions for life-threatening scenarios were raised.

2. Ransomware payment prevention regime: this regime would require victims to report their intent to pay ransoms, allowing the Government to assess and potentially block payments to sanctioned groups. Feedback was mixed, with 47% supporting an economy-wide approach, but concerns were highlighted around thresholds creating loopholes for attackers. Respondents also stressed the importance of guidance and support for compliance, particularly for small businesses.

3. Mandatory incident reporting regime: this proposal mandates victims to report ransomware incidents within 72 hours, followed by a detailed report within 28 days. It received strong backing, with 63% agreeing to an economy-wide mandatory reporting system. Respondents noted that such a regime would strengthen intelligence gathering and law enforcement’s ability to address ransomware threats. However, concerns were raised about reporting burdens on individuals and smaller organisations.

Next Steps

The Government is proceeding with developing these measures, taking into account the feedback received. Key actions include:

• Publishing detailed guidance to clarify the scope and implementation of the proposals
• Exploring proportional penalties and tailored compliance measures for organisations of different sizes and sectors
• Strengthening victim support services, including expert guidance, operational updates, and intelligence sharing
• Maintaining the proposed 72-hour reporting window for initial incident notifications

Read more about the Government’s position here and the outcome of the consultation here. If you would like more information, please feel free to reach out to one of our dedicated cyber security lawyers, or if you would like keep up to date on the latest in data protection, please subscribe to our quarterly newsletter, The Data Download, and watch our recent webinar here.

AUTHORS

Michael Yates Partner

Michael is an information litigator who specialises in advising individuals and companies on reputation management, cyber crisis management and information, data privacy and media law disputes.

Michael is an information litigator who specialises in advising individuals and companies on reputation management, cyber crisis management and information, data privacy and media law disputes.

He covers the full spectrum of contentious matters, including in-print and online defamation, malicious falsehood, misuse of privacy information, breach of confidence, data protection, cyber attacks, data breaches, information theft, harassment, blackmail, right to be forgotten and subject access requests. He also advised on regulatory media and data complaints, reporting restrictions, NDAs, injunction applications, Norwich Pharmacal applications, online takedowns, apologies, damages claims and coroners' proceedings.

Michael often urgently advises clients who are in a crisis, typically when trying to protect reputation by stopping or mitigating the publication or broadcast of a false story, project managing a response to a cyber attack or preventing the unlawful misuse or disclose of information. He also provides regular training and preparedness sessions to clients to help get ahead of a media or cyber crisis.

He also protects publishers, platforms, data controllers and processors from legal claims.

Michael is ranked as ‘Up and coming’ in Chambers and Partners and is ‘Recommended’ by Spears Magazine.

Nadia Ahmed Associate

Nadia is an associate specialising in data protection, privacy and information law.

Nadia is an associate specialising in data protection, privacy and information law.

She advises on compliance with data protection laws and information laws, including the UK and EU General Data Protection Regulation (GDPR), the Data Protection Act 2018, the Freedom of Information Act (FOIA) and codes of practice issued by the ICO and other data protection regulators.

She assist clients with data protection agreements/addendums (DPA), data protection impact assessments (DPIA), drafting and reviewing privacy policies and cookies policies and cookie banners. Nadia handles contentious data protection matters too such as communications with the ICO, personal data breaches and data subject requests such as data subject access requests (DSAR). She keep clients informed of any changes to data protection laws and updated guidance from data protection regulators, and provides training to legal teams and employees on data protection best practices. Nadia has also been seconded to help ensure compliance with GDPR and information law procedures are effective and meet the necessary standards.

Nadia works with a wide range of clients, from small businesses to large corporations, to help them understand their legal obligations and develop data protection strategies and programmes for compliance with data protection laws. Such clients include those in the fashion and retail sector, streaming services, gaming, technology and more.

Nadia has completed the Certified Information Privacy Professionals/Europe (CIPP/E) by IAPP and is a member of the Society for Computers and Law.