Ransomware Attacks Remaking Cyber as National Priority

Non-stop, high-profile ransomware attacks against Britain and the United States have transformed cybersecurity into a national security priority, Anne Neuberger, the former White House deputy national security adviser for cyber, said at a Wednesday event in London.

See Also: Top 10 Technical Predictions for 2025

“For too long, it’s been a tech thing, ‘go get your CIO to fix it,'” Neuberger told attendees at an event hosted by think tank Royal United Services Institute, where she serves as a distinguished fellow.

Increasingly, ransomware attacks aren’t just disrupting private businesses, but having a more society-wide impact. With the higher costs becoming “no longer tenable,” she said, governments are “bringing in CEOs and saying: ‘OK, this is a national problem, these are private networks, how do we tackle this together and really come up with a coordinated approach’?”

Calls for private organizations to sharpen their defenses have been on the rise following a spate of high-profile incidents creating national fallout. In the United Kingdom, this has included ransomware attacks on major retailers, including in late April against Marks & Spencer, which disrupted a national icon and left it with a cleanup bill of nearly $400 million. In September, an attack on British carmaker Jaguar Land Rover halted production, disrupted national supply chains and sales, and has so far cost the company an estimated $260 million. Estimates suggest fallout from the hack and its spillover effects could cost the U.K. economy $2.5 billion.

Those incidents prompted parliamentary scrutiny, with executives from the breached businesses testifying that the U.K. government must strengthen its support for companies as they face increasingly sophisticated cyberattacks. Some cybersecurity experts have also questioned whether firms such as JLR were devoting sufficient time and budget to maintain their defenses.

In the United States, Neuberger – who served as President Biden’s deputy national security adviser for cyber and emerging technology from January 2021 to 2025 – said the 2021 Colonial Pipeline attack, attributed to the DarkSide ransomware group, triggered similar discussions and policy shifts.

That attack, which disrupted fuel supplies along the Eastern Seaboard, led Biden to demand that Russian President Vladimir Putin disrupt cybercriminal groups operating from inside his territory, said Neuberger, who currently also serves as a senior adviser at venture capital firm a16z.

“The Russians initially acted: they publicly arrested the person responsible for the Colonial Pipeline attack,” Neuberger said. “But three months later, after they invaded Ukraine, their priorities shifted, and any type of approach in this space went off the table.”

With diplomacy no longer a ready tool, proposed British government policy measures such as a ban on ransom payments might help drive better cyber response and resilience, together with increased private-public partnerships, Neuberger said.

But she said any effective long-term strategy must also involve better disrupting the financial infrastructure that facilitates ransomware, including cryptocurrency.

“Crypto is what scaled it, because you can deliver money easily,” she said. “We need to ask ourselves what actually turns off the money flow.”

Although the U.S. government has sanctioned multiple crypto mixers used by Russian groups to obscure illicit funds, such as Sinbad and Blender, such measures must be applied more frequently and aggressively to be truly effective, Neuberger said.

“The problem is you have to keep doing them quickly and effectively. If you hit one mixer and wait four months, they rebuild. We need to make it genuinely painful for virtual asset service providers that are enabling the movement of ransomware funds,” she said.