The Netherlands not in favor of legal ban on ransom payments to hackers

The government of the Netherlands doesn’t like the idea of implementing a statutory ban on paying ransom in case of a ransomware attack.

“Falling victim to extortion schemes can have a significant impact. The damage can be enormous and puts the affected company in a difficult position, including with regard to its customers,” David van Weel, Minister of the Department of Justice and Security, says in a letter addressed to the House of Representatives.

The final decision on whether to pay a ransom or not rests with the affected organization. The government’s advice remains not to pay.

“Paying ransom offers no guarantee that criminals will restore systems, delete stolen data, or refrain from making it public or selling it to other criminals. Furthermore, paying ransom perpetuates the business model of cybercriminals,” the Minister continues.

Asked whether a statutory ban on paying ransom could favor society as a whole, Van Weel is reluctant.

“We do not wish to criminalize organizations that have fallen victim to a ransomware attack. There may be a tension between an individual victim’s interest in minimizing damage in the short term and the broader societal interest in reducing the total number of (potential) victims and not perpetuating the criminals’ business model. As long as this tension cannot be resolved unequivocally, it is, as in most EU countries, strongly advised not to pay the ransom, rather than imposing a legal ban,” he says.

The Minister stated this in response to questions regarding the cyberattack on Odido.

Ransomware extortion group ShinyHunters managed to steal personal information of more than six million people and threatened to publish the data on the dark web.

Odido continuously said it wouldn’t negotiate or pay the attackers. Therefore, ShinyHunters decided to publish all the stolen data.

A spokesperson of the Dutch Public Prosecution Service has confirmed that an investigation has been launched into the matter.

The data protection authority (DPA) and Dutch Authority for Digital Infrastructure (RDI) are investigating how long Odido retained customer information and whether the company properly secured the data.

Unlock more exclusive Cybernews content on YouTube.