Ransomware Attack: The Corporate Liability Of Reporting In Mainland China

Though ransomware made worldwide headlines twice this year through the Wannacry worm and the Petya/NotPetya attack, most companies are still hesitant on the proper steps to take following a ransomware attack. Still, companies following an attack would have to walk through the compliance path, both for the sake of business continuity, and to fulfill their reporting obligation set by law and contractual terms. This reporting obligation has been greatly discussed since the adoption on 7 November 2016 of the Cybersecurity Law (CSL), in particular its scope, what should be reported to the authorities and when such report should take place. As time flew after the adoption of the law and major cyber-incidents occurred in 2017, we will discuss the reporting obligation as per Article 25 of the CSL and provide companies with a clearer understanding of their legal and contractual reporting obligation.