When the Screens Go Dark and the Ransom Note Appears
The operations manager arrives at the office one morning to find every file on the company's servers encrypted. Instead of the usual desktop environment, a message appears demanding payment in cryptocurrency in exchange for a decryption key. Within minutes, it becomes clear that the system controlling customer orders, financial records, and employee data is no longer accessible.
A ransomware attack differs from other cyber incidents. Within a matter of hours, it combines severe business disruption, a suspected exposure of personal data, and often a complicated legal dilemma over whether to pay the ransom. Israeli technology companies, including SaaS providers and e-commerce platforms, are prime targets given the volume of data they hold and how heavily their customers depend on continuous service availability.
This article focuses on the legal issues unique to a ransomware event, including reporting obligations to regulators, the considerations that go into a ransom payment decision, and how to manage the crisis with customers, employees, and the board. The information reflects the law as of the date of writing, and because this area develops quickly, each incident should be assessed on its own facts as it unfolds.
The First Hours: Containment While Preserving Legal Privilege
The steps taken in the first hours after discovering an attack affect both the scope of the damage and the company's legal position going forward. It is advisable to bring legal counsel into the process at this early stage, rather than only once the picture becomes clearer.
- Isolate the affected systems from the company network immediately, without shutting them down entirely, in order to preserve digital evidence.
- Engage outside counsel from the outset, so that communications with forensic investigators can proceed under attorney-client privilege, to the extent recognized under applicable law.
- Retain a qualified forensic investigation team, working under counsel's direction, to determine the scope of the intrusion and what data may have been exposed.
- Notify the company's cyber insurer promptly, in accordance with the policy's terms, since a delayed notification can jeopardize coverage.
- Avoid direct contact with the attackers without legal guidance, even under pressure to respond quickly.
Every decision and every step in the response should be documented carefully. Organized documentation serves the company well both with law enforcement and in any potential civil claims down the line.
Reporting Obligations Under Israeli Law
The Privacy Protection Law, 5741-1981, as amended by Amendment 13 (in force since August 14, 2025), imposes a duty to notify the Privacy Protection Authority in the event of a severe security incident, as defined under the Privacy Protection Regulations (Data Security). A ransomware attack, where there is a suspicion that personal data has been encrypted, exfiltrated, or exposed, may fall within this definition, and each incident should be evaluated individually against the timeframe set out in the regulations.
Beyond notifying the Authority, a duty to inform the affected data subjects themselves may also arise, depending on the severity of the incident and the type of data exposed. It is worth noting that Amendment 13 significantly expanded the Privacy Protection Authority's enforcement powers, including audit tools and the ability to impose administrative fines.
- Filing a complaint with the Israel Police, generally through the national cyber unit, even where the company does not intend to pay a ransom.
- Considering whether to contact the National Cyber Directorate for professional guidance, particularly where critical infrastructure or a significant intrusion is involved.
- Companies operating under sectoral regulation, such as banking corporations supervised by the Bank of Israel or entities regulated by the Capital Market, Insurance and Savings Authority, are subject to additional reporting duties set out in the relevant regulator's directives.
- Public companies may be required to make immediate disclosure to the Israel Securities Authority if the incident constitutes material information affecting the company's condition.
- If the incident exposes the data of individuals in the European Union, reporting obligations under the GDPR should be reviewed alongside Israeli law.
Paying or Refusing: The Legal Considerations Behind a Ransom Decision
Israeli law does not impose a blanket prohibition on paying ransom to cyber attackers, but the decision carries layers of legal risk that must be examined before any payment is made. Paying an entity identified as a terrorist organization, or one subject to international sanctions, may expose the company to liability under the Prohibition on Terrorism Financing Law, 5765-2005, as well as under foreign sanctions regimes relevant to the company's international activity.
In practice, it is often difficult to know with certainty who is behind an attack, which is why legal due diligence before any payment matters, including checking digital wallet addresses against known sanctions lists to the extent possible.
- Paying a ransom does not guarantee receipt of a working decryption key, and it does not prevent the attackers from publishing stolen data regardless.
- A cyber insurance policy may impose preconditions on ransom payment, including obtaining the insurer's prior approval.
- It is advisable to work through professional ransomware negotiators, under legal supervision, rather than engaging directly with the attackers.
- A decision to pay a ransom should be made and documented at the board or senior management level, given the duty of care imposed on company officers.
Crisis Management: Communicating With the Board, Employees, and Customers
A ransomware attack is also a management event, not only a technical and legal one. A crisis team should be assembled quickly, comprising representatives from management, IT, legal, and communications, operating according to predefined procedures rather than improvisation.
- Update the board at an early stage, consistent with the oversight duties imposed on officers in the cyber context.
- Provide employees with clear instructions, including a prohibition on sharing details on social media until an official position has been formulated.
- Prepare consistent messaging for customers and business partners, based only on verified facts rather than assumptions.
- Coordinate with external communications advisors so that public statements do not contradict official filings made to regulators.
- Engage proactively and early with the relevant regulator, since transparent cooperation tends to reduce the company's exposure to enforcement action.
Statements made too early or in too much detail, before the facts are established, can create additional exposure if the initial information later proves inaccurate or incomplete.
Contractual Obligations, Cyber Insurance, and Liability Exposure
As soon as the incident is contained, the company's full set of contractual obligations should be reviewed. Customer service agreements, data processing agreements with vendors, and SLAs may impose independent notification duties that are separate from statutory reporting obligations.
- Review DPAs with enterprise customers, which may require notification within a timeframe substantially shorter than that set out by law.
- Examine the terms of the cyber insurance policy, including coverage for ransom payments, forensic costs, business interruption, and any requirement to use vendors approved by the insurer.
- Assess exposure to class action claims from customers or affected data subjects, particularly where sensitive data is involved.
- Preserve all legal and technical documentation of the response process, as it may serve as key evidence in future proceedings.
Companies that maintain well-structured contracts with cloud and infrastructure providers, which allocate responsibility in advance for a cyber incident, find themselves in a significantly better position when a crisis actually occurs.
After the Storm: Lessons Learned and Future Preparedness
Once the incident is closed, a structured post-mortem should examine what worked and what did not, and the company's cyber incident response plan should be updated accordingly. Periodic tabletop exercises that include a full ransomware scenario help teams perform better under real-world pressure.
- Update data security policy and backup procedures based on the lessons learned.
- Reassess access permissions to critical systems and intrusion detection mechanisms.
- Establish working relationships with counsel and a forensic team in advance, so that valuable time is not lost identifying the right people during an actual incident.
- Update the cyber insurance policy to reflect the company's updated risk profile.
A ransomware attack is not merely a passing technical incident. It is a real test of a company's managerial and legal capacity to operate under pressure, meet its legal obligations, and preserve the trust of customers and the market. Early preparation, a clear understanding of reporting duties, and a well-considered policy on the ransom payment question are the tools that separate a swift recovery from a prolonged crisis.
The information contained in this article is general in nature and does not constitute legal advice. For advice tailored to the specific circumstances of your company, we invite you to contact our firm.
