NYDFS Issues New Ransomware Prevention Guidance

The New York State Department of Financial Services ("NYDFS") issued new guidance on ransomware prevention. NYDFS highlighted cybersecurity measures to significantly reduce the risk of an attack.

In an industry letter, the NYDFS recommended - in step with the FBI - against paying ransoms because such payments (i) may violate the Treasury's OFAC sanctions, (ii) do not guarantee that the company will regain access to all its data, or that the company's data will not be leaked later anyway, and (iii) for most of those that paid, did not prevent subsequent attacks. The NYDFS indicated that it received reports of 74 ransomware attacks from DFS-regulated companies between January 2020 and May 2021, and it found that all the incidents followed a similar pattern: hackers (i) enter a victim's network through phishing, or exploiting unpatched vulnerabilities or poorly secured Remote Desktop Protocols ("RDPs"), (ii) obtain administrator privileges after gaining access to the