American companies targeted by ransomware attacks would be required to disclose payments made in connection with those incidents under a new law proposed in Congress.
Introduced by Senator Elizabeth Warren (D-MA) and Representative Deborah Ross (D-NC), the Ransom Disclosure Act would, per an announcement from earlier this week:
“[R]equire ransomware victims (excluding individuals) to disclose information about ransom payments no later than 48 hours after the date of payment, including the amount of ransom demanded and paid, the type of currency used for payment of the ransom, and any known information about the entity demanding the ransom.”
Additionally, the bill proposes that the U.S. Department of Homeland Security be required to make disclosure information available on an annual basis, though no identifying information about the payees would be disclosed. DHS leadership would also establish a web portal for voluntary disclosure and prepare a study “on commonalities among rans
