Ransomware

Ransomware is a type of malware. The U.S. Cybersecurity and Infrastructure Security Agency describes it as malware designed to encrypt files on a device, making the files and the systems that rely on them unusable, after which the attackers demand a ransom for the decryption key. Modern gangs usually steal a copy of the data first, then threaten to sell or leak it if the company does not pay. That second step is what turns a company's outage into your privacy problem.

Ransomware is one of the most common causes of the data breaches behind class action lawsuits. Hospitals, medical labs, schools, payroll companies, and software vendors hold large amounts of personal and health data, and a single attack can expose names, Social Security numbers, dates of birth, and medical records for millions of people. When a ransomware attack exposes personal information, the company typically must send breach notice letters under state law, and those letters are often what trigger class action filings within days.

Lawsuits after ransomware attacks usually claim the company was negligent: it failed to use basic security such as multifactor authentication, encryption, and timely patching, or waited too long to tell people. Settlements often include reimbursement for documented losses, payments for time spent, credit monitoring, and sometimes a flat cash payment. Individual payouts are often small, because the fund is split among many people.

If you got a breach letter, start with our guide on what to do after a data breach notice, check the data breach lawsuit page, and see how much a data breach settlement is worth.