Industry Letter  Ransomware

Date:	05/23/2016
Referenced Sources:	Statement on Destructive Malware Joint Statement on Cyber Attacks Involving Extortion

To the Chief Executive Officer Addressed:

Ransomware is a form of malicious software (malware) that typically encrypts data, making it inaccessible until a fee (ransom) is paid to the criminals.  Several financial institutions across the country have been the targets of such attacks.  Ransomware is one of the fasting growing forms of malware and warrants the attention of Chief Executive Officers as well as all institution personnel.

The attached document from the FBI’s Cyber Division provides information about this threat and options for managing it.  It includes some technical aspects of prevention; as such, technical staff should be consulted to determine which suggestions are practical for your institution’s operations.

NOTE: The FBI document should not be shared with media or posted on any publicly accessible website; however, the information can be shared with external firms that provide your technical support.

Additionally, the Federal Financial Institutions Examination Council (FFIEC) released two joint statements in 2015 that include controls that could help mitigate the risks of ransomware.  They contain many technical suggestions and, while your staff may have reviewed those documents last year, this information should be reviewed again in light of the increasing incidents of ransomware hitting financial institutions.

• The Statement on Destructive Malware was released on March 30, 2015. 
• The Joint Statement on Cyber Attacks Involving Extortion was released on November 3, 2015.

Cyber threats will continue to plague us in the coming years.  I encourage you to continue developing a culture of security within your institution.  If you have any questions about the attached notice or other documents related to cybersecurity, please contact Regional Field Manager Holly Chase via email at [e-mail] or at [phone] extension 409.

Sincerely,

David J. Cotney

Commissioner of Banks