Proposed Bill Requires Organizations to Report Ransomware Payments

Massachusetts senator Elizabeth Warren and US House Representative Deborah Ross introduced a bill which would require organizations to report all ransomware payments to the Department of Homeland Security (DHS). This bill applies to companies, local governments, and nonprofits that decide to pay the ransom hackers demand within 48 hours of the payment. The details organizations are required to provide include the date the ransom was demanded, the date it was paid, the amount of the ransom demanded, the amount of ransom paid, the type of currency used (including fiat currency and cryptocurrencies), as well as any information known about the threat actors. The proposed bill also requires the DHS to publicize an anonymized version of the disclosed information every year. Similar bills have been introduced but none have affected this many organizations or required publicizing the information.