Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Ohio Clock

Hallway with a grandfather clock displayed

Congress Faces Pre-election Budget Vote to Avoid Government Shutdown

Senate Passes Kids Online Safety Measure But House Passage Unclear

Current State of U.S. Economic Sanctions Imposed in Response to Russia’s Invasion of Ukraine – August 29, 2024

Current State of U.S. Export Controls in Response to the Russian Federation’s Invasion of Ukraine – August 29, 2024

<figure class="wp-block-image alignright size-full is-resized"><img decoding="async" loading="lazy" src="https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/DADM_GettyImages-1155359725_1200x630-662x348-1.jpg" alt="Block chain - abstract background technology image, concept for Block chain, big data analytics, data science, cloud big data" class="wp-image-1716" width="411" height="213"/></figure>



On April 5th, North Carolina became the first state to prohibit state agencies and local governments from paying ransoms after becoming victims of a ransomware attack. Indeed, in addition to prohibiting said entities from paying ransoms, North Carolina’s new <a href="https://www.ncleg.gov/EnactedLegislation/SessionLaws/HTML/2021-2022/SL2021-180.html">law</a> actually goes so far as to prohibit a public entity from even communicating with threat actors in response to a ransomware incident. The law also requires any North Carolina public entity that experiences a ransomware incident to “consult with” the North Carolina Department of Information Technology, in accordance with <a href="https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_143B/GS_143B-1379.html">G.S. 143B‑1379</a>.



In 2021, BakerHostetler handled more than 1,270 matters that involved data security incidents such as ransomware attacks. (See <a href="https://www.bakerlaw.com/BakerHostetler-Launches-2022-Data-Security-Incident-Response-Report-Resilience-and-Perseverance">2022 BakerHostetler Data Security Incident Response Report</a>.) Twelve percent of those matters were for clients in the education sector. The average ransom demand was over $1.5 million, and the average amount paid reached nearly $200,000.



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="624" height="49" src="https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom1.png" alt="ransom Titles of columns" class="wp-image-1715" srcset="https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom1.png 624w, https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom1-300x24.png 300w" sizes="(max-width: 624px) 100vw, 624px" /></figure>



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="624" height="86" src="https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom2.png" alt="Ransom 2 Columns" class="wp-image-1714" srcset="https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom2.png 624w, https://admin.bakerdatacounsel.com/wp-content/uploads/2023/07/ransom2-300x41.png 300w" sizes="(max-width: 624px) 100vw, 624px" /></figure>



North Carolina’s new law specifically includes local school administrative units, community colleges and The University of North Carolina in the list of public entities prohibited from paying a ransom. Accordingly, North Carolina public schools impacted by ransomware are no longer permitted to purchase decryption keys, pay threat actors not to publish on the dark web information stolen from school servers, or even engage in communications with threat actors to gain intelligence about the nature and scope of the incident.



Ideally, given that public schools (and other entities) in North Carolina are no longer permitted to purchase decryptors from threat actors that encrypt their systems with ransomware, said threat actors will not waste their time and energy directing cyberattacks at North Carolina schools. Unfortunately, we all know that will not be the case. Therefore, it is imperative that North Carolina public schools take proactive steps to make sure they are in the best position possible to prevent a ransomware attack from happening or, if it does happen, to be able to recover without having to rebuild their entire server environment.



To that end, below are some key tips that schools should consider:



<ul>
<li>Because schools often have limited resources to expend on cybersecurity, they should know where the crown jewels are and prioritize protecting and backing up the most critical systems and data.</li>



<li>Speaking of backups, schools should make sure that backups are performed regularly and are stored in such a way that they would still be accessible in the event of a ransomware attack.</li>



<li>Implement multifactor authentication wherever<a> </a>possible and especially on remote connections, including email.</li>



<li>Deploy endpoint detection and response tools on school-managed devices and endpoints, and make sure that the endpoint telemetry is monitored on a 24/7/365 basis.</li>



<li>Develop an incident response plan that sets forth manual workarounds to avoid disruption in operations in the event a ransomware incident occurs and systems and data are unavailable.</li>
</ul>



Proactively addressing cybersecurity risks is the only option for North Carolina schools. If a school or other public entity in North Carolina becomes a victim of ransomware, it won’t be able to pay for a decryption key. To avoid the loss of important data and the interruption of classes and other programs, schools should prioritize cybersecurity now.

core/freeform

Data Counsel

Philadelphia

Counsel

Benjamin D. Wanger

Cincinnati

Associate

Elise R. Elam

Digital Risk Advisory and Cybersecurity

Digital Assets and Data Management

North Carolina is the First State to Prohibit Public Entities from Paying Ransoms: What Does This Mean for North Carolina Public Schools and Universities?

Related Services

Featured Insights