Navigating Breach Disclosures: Insights from Global Cyber and Legal Experts

One of the most recent significant cyber security incidents was the SolarWinds breach. Hackers inserted malicious code into SolarWinds' Orion software, which was then distributed to thousands of customers, including government agencies and large corporations. This breach exposed sensitive data and highlighted the critical need for stringent regulatory compliance and proactive disclosure practices. The SEC's involvement in this case has set a precedent for how such incidents should be managed and reported, emphasizing transparency and accountability.

Our webinar series kicked off in the APAC region to discuss this butterfly effect, where our speakers explored the complexities of regulatory compliance affecting different jurisdictions, stressing the need for cyber and legals teams to stay ahead of these changes.

Our guest from K+L Gates discussed the complexities of regulatory compliance across different jurisdictions in APAC, stressing the need for organizations to stay ahead of these changes.

NCC Group's latest Global Cyber Policy Radar finds that incident reporting requirements have grown considerably in scale and complexity. In response to a perceived underreporting of cyber attacks, governments are implementing new and strengthened incident reporting requirements. While the rationale for these interventions is understandable, the result of these national-level initiatives is a complex web of global incident reporting rules for organizations (of all shapes and sizes) to navigate. 

Across these requirements, we see notable differences in which organizations need to make the report, the types of incidents that need to be reported, the body to which the report needs to be made, and the reporting timelines. 

"The regulatory landscape is continuously evolving, with increasing pressure on cyber and legal teams to adapt to new requirements. This complexity requires a close collaboration between technical and legal experts to navigate the myriad of regulations and ensure compliance while effectively managing cyber threats." 

Global Head of Digital Forensics and Incident Response | NCC Group

During our session with Kennedy Van der Laan in the Netherlands, Rosalie Brand highlighted some of the complexities of Ransomware payments. 

The University of Maastricht faced a ransomware attack that forced them to make a difficult decision—pay the ransom or risk losing critical data. They chose to pay, and fortunately, law enforcement later recovered some of the funds after catching the threat actors. 

This example underscores the complexities surrounding ransomware payments, which are set to grow as governments consider banning organizations from making them. It also highlights the importance of having a well-thought-out incident response plan and the role of law enforcement in mitigating the impact of such attacks.

The crackdown on the LockBit ransomware gang provided a temporary respite from the surge in ransomware attacks. However, as cybercriminals regroup and adapt, the threat continues to grow, highlighting the importance of international cooperation in combating cybercrime and the need for continuous vigilance. Organizations must stay updated on the latest threat intelligence and ensure their cyber security measures are robust and adaptable.

"It's not a clear answer whether you should pay a ransom or not; you need to consider all aspects. Sometimes you don't have a choice, especially if lives are at risk or business continuity is severely impacted." 

Rosalie Brand, Partner, Privacy and Head of Cyber | Kennedy Van der Laan

Webinar global poll highlight:

If you experienced a ransomware attack on your environment, would you pay, and are you allowed to?

• Majority against paying: Across all regions, most respondents indicated they would not pay ransomware demands.

• Policy restrictions: A significant portion of respondents indicated that their policies prohibit paying ransomware.

• Uncertainty: A notable percentage of respondents were unsure whether they would pay, highlighting the need for clearer policies and guidelines.

Our session with Norton Rose Fulbright in the US underscored the critical role of forensic preparedness in incident response. As cyber threats evolve at an unprecedented pace, the ability to effectively remediate and execute timely responses becomes paramount. The discoverability of incident data should drive robust remediation planning, ensuring that organizations are prepared to act swiftly and decisively.

Digital forensics readiness is essential across all organizations; incident data will increasingly be treated as potential digital evidence. Preserving the chain of custody as a standard practice ensures that all evidence is handled with the utmost integrity and reliability.

"To protect Attorney-Client Privilege, organizations must involve legal counsel early, secure communications, and adhere to best practices, while being mindful of jurisdictional differences in privilege application."

Jim Arnold, Senior Counsel | Norton Rose Fulbright