IIROC Publishes Notice Regarding Ransomware Attacks

The Investment Industry Regulatory Organization of Canada ("IIROC") has published a Cybersecurity Notice on Ransomware (the "Notice"), which flags a recent uptick in ransomware attacks on IIROC firms and provides guidance on how IIROC firms should prevent, detect, respond to and recover from ransomware attacks. 

Ransomware has become the most common cyber-crime. While ransomware inherently consists of a malware-based attack on computer systems that results in encryption of data and a demand for ransom, it now increasingly involves a "double extortion" model, where sensitive data (personal information and/or confidential business data) are exfiltrated from those systems, with a threat to release them publicly if a ransom is not paid.