Briefing
How ransomware lawsuits work
A ransomware attack is a crime against the company. Whether it is also a legal wrong against you depends on what the company did before the attack, and how it treated you after.
Who gets sued
Not the criminal group. They are usually overseas and out of reach. Lawsuits after a ransomware attack are brought against the company that held the data, and sometimes against vendors whose systems were the way in.
The usual legal theories
Negligence (the company failed to use reasonable security), breach of implied contract (it promised to protect your data when it collected it), unjust enrichment, and claims under state consumer-protection and data-breach statutes. California’s Consumer Privacy Act gives a direct right to sue for certain breaches.
What evidence matters
The state breach filing, the notice letter, the timeline from intrusion to discovery to notice, the types of data taken, and any later reports on how attackers got in. Public statements on leak sites can point to exfiltration, but they are claims by criminals and are weighed with care.
Class action or individual claim
Large breaches usually become class actions, where a few people represent everyone affected and settlements pay for losses, time spent and monitoring. People with serious, documented harm, such as identity theft or fraud losses, sometimes do better with an individual claim.
Deadlines
Statutes of limitations differ by state and by claim. The date on your notice letter can matter, so keep it.
Research sources
Outside trackers and agencies useful when piecing together what happened in an attack.
- GovernmentCISA #StopRansomware alertsOfficial U.S. government advisories and statements on active ransomware threats.
- Leak-site trackerRansomware.liveA free tracker of victim posts on ransomware group leak sites.
- Leak-site trackerComparitech ransomware trackerA map and database of ransomware attacks on organizations around the world.
- Leak-site trackerSOCRadar ransomware victimsA free intelligence tool listing organizations named by ransomware groups.
- Leak-site trackerRansomDBA searchable database of ransomware groups and the victims they claim.
- Leak-site trackerRansomFeedA feed that monitors ransomware leak sites and logs new claims as they appear.
- ResearchGroup-IB ransomware notesA library of ransom notes left by known ransomware families.
- NewsThe Hacker News: ransomwareSecurity news coverage of ransomware attacks, groups and arrests.
- NewsSuspectFileIndependent reporting on ransomware incidents and data leaks.
Outside sites, not affiliated with us. Leak-site trackers repeat what criminal groups claim; a listing there is not proof that a company was attacked or that your information was taken. Your company’s official breach notice and its state filing are the record that matters for a claim.
General information, not legal advice. Attorney advertising.