There is a high risk that the Government will face a “catastrophic ransomware attack” at any moment, according to a new report by the Joint Committee on the National Security Strategy.

The report found that while the government and National Cyber Security Centre (NCSC) have primarily focused on resilience, large amounts of critical national infrastructure (CNI) remain vulnerable to ransomware attacks, especially if they rely on legacy IT systems.

The committee said it was concerned about underfunded sectors such as health and local government, adding that supply chains are particularly vulnerable to cyber-attacks.

The report found that due to these vulnerabilities, a targeted attack had the potential to take down significant parts of UK CNI and public services, causing severe damage to the economy.

The report calls on the government to hold regular exercises to prepare for the impact of a national ransomware attack and consider setting up a cross-sector regulator on CNI cyber resilience.

The study claims that the former Home Secretary “showed no interest” in ransomware as a national security risk and policy issue, suggesting that there were other political priorities in the Home Office at the time like illegal migration.

The committee found that the government’s reporting on its progress in implementing the National Cyber Strategy (NCS) was “poor”, urging it to bring forward legislation to update the Computer misuse Act which is over 30 years old.

“The impact of a ransomware attack on its victims is significant, with many organisations taking months to recover,” the report said. “Despite this, most victims currently receive next-to-no support from law enforcement or Government agencies.

“If the UK is to avoid being held hostage to fortune, it is vital that ransomware becomes a more pressing political priority, and that more resources are devoted to tackling this pernicious threat to the UK’s national security.”

---