A company lost your data in a ransomware attack. Here is what to do.

What is a ransomware attack?

Ransomware is malicious software that locks a company’s files and systems until a ransom is paid. Most groups operating today also copy data out of the network first, then threaten to publish it. Security teams call this double extortion.

For you, the second part is what matters. Locked servers are the company’s problem. Copied files containing your name, Social Security number, account numbers or medical records are yours.

If the files were only encrypted, is my data safe?

Not necessarily. Companies often cannot prove what attackers copied before encryption, so their letters say information “may have been accessed.” Under most state laws, that is enough to require a notice.

Treat a ransomware notice as if your information was taken. If the company later learns more, it may send an updated letter.

Does it matter whether the company paid?

Paying does not guarantee the attackers delete anything. Stolen data from attacks where a ransom was paid has later turned up for sale. Whether or not the company paid, your protective steps are the same.

What should I do after getting a ransomware breach letter?

Place a free credit freeze with Equifax, Experian and TransUnion. A freeze stops new accounts from being opened in your name and does not affect your score.

Enroll in any credit or identity monitoring offered in the letter before its deadline. Change any password used on the affected account or reused elsewhere, and turn on two-factor sign-in.

If medical information was involved, review the explanation-of-benefits statements from your insurer for care you did not receive. If your Social Security number was involved, consider an IRS Identity Protection PIN.

Keep the letter and the envelope. The date you were notified can matter for deadlines.

Can you sue a company after a ransomware attack?

Being the victim of a criminal attack does not excuse a company from protecting your information. Lawsuits after ransomware attacks usually argue the company failed to use reasonable security, such as patching known vulnerabilities, requiring multi-factor sign-in, or limiting how long it kept old data. Some also challenge how long the company waited to notify people.

Many of these cases proceed as class actions. Others are resolved through settlements that reimburse lost time, out-of-pocket costs and identity theft losses. Whether you have a claim depends on what was taken, your state’s law and what has happened to you since.

What does it cost to talk to a lawyer?

Nothing. David S. Harris, Esq. reviews ransomware and data breach notices for free, and these cases are handled on contingency: no fee unless there is a recovery.