Ransomware & Cyber Threats

What is ransomware

Ransomware is malware that encrypts victim data and demands payment (typically in cryptocurrency) for the decryption key. Modern variants practise double extortion: in addition to encrypting data, they exfiltrate it and threaten to publish it if the ransom is not paid. Some groups have progressed to triple extortion, adding DDoS attacks or contacting the victim’s customers directly.

Common attack vectors

• Phishing and spear-phishing: fraudulent emails tricking employees into downloading malware or revealing credentials
• Vulnerability exploitation: unpatched software (VPNs, web servers, public-facing applications)
• Compromised remote access: stolen or weak RDP credentials
• Supply chain attacks: compromising a software vendor to distribute malware to its customers

Legal notification obligations

A ransomware attack in the EU triggers multiple concurrent notification requirements:

• GDPR: notification to the supervisory authority (AEPD in Spain) within 72 hours if personal data is affected
• NIS2: early warning within 24 hours and full notification within 72 hours to the reference CSIRT
• DORA: for financial entities, notification to the financial supervisor under prescribed timelines
• Securities regulation: listed companies may need to disclose material cyber incidents

Prevention and response

Effective prevention combines technical measures (immutable backups, network segmentation, EDR, multi-factor authentication, regular patching) with organisational measures (employee training, phishing simulations, tested incident response plans). The decision to pay a ransom has legal, ethical, and strategic implications — including potential sanctions law violations — that require specialist advice.