In a scathing report released on Wednesday, the Joint Committee on the National Security Strategy (JCNSS) warned that the UK Government’s failures to address the growing threat of ransomware pose a “high risk” of a catastrophic attack at any moment. 

The report singles out former home secretary Suella Braverman for the shortcomings, despite her department claiming to lead the government’s efforts on the national security risk and policy matter.

“The Home Office claims the lead on ransomware as a national security risk and policy issue, but the former Home Secretary showed no interest in the topic,” read the report.  

In response to these findings, the report calls for a significant shift in responsibility, urging the Home Office to be stripped of its role in handling ransomware. Instead, the Cabinet Office, in collaboration with the National Cyber Security Centre (NCSC) and National Crime Agency (NCA), should take charge, directly overseen by the deputy prime minister, Oliver Dowden, as part of a holistic approach to cyber resilience.

This revelation comes on the tail end of a year which has seen a surge in ransomware attacks, with March of this year assessed as the “worst month on record,” for victims whose data has been stolen and posted on the dark web, according to the Parliamentary report. This has caused the NCSC to make ransomware the number one cyber security threat to the UK.

“The UK has the dubious distinction of being one of the world’s most cyber-attacked nations. It is clear to the Committee that the Government’s investment in and response to this threat are not equally world-beating,” Dame Margaret Beckett, the chair of the JCNSS.

Recommended reading

• NCSC Reveals Russian Cyber Interference in UK Politics
• Ransomware Attacks up 81% Year-on-year in October
• New Ransomware Gangs Driving Attack Surge

In response to the report, a government spokesperson stated that they welcomed the findings and would publish a full response in due course, according to The Record. The spokesperson highlighted recent actions, including two tranches of sanctions targeting 18 criminals in the ransomware ecosystem and the government’s participation in the Counter Ransomware Initiative, denouncing ransom payments internationally.

However, they emphasised that there were no plans to remove the Home Office’s role as the lead department for cybercrime.