Alberta Dental Service Corporation: Responding to a Cyberattack Crisis

In July 2023, Alberta Dental Service Corporation (ADSC), a non-profit organization that administered publicly funded dental benefit programs on behalf of the Government of Alberta, became the victim of a double-extortion ransomware when data regarding 1.47 million individuals and dental service providers was copied to an outside location and data found on the ADSC’s system was encrypted, making it unusable. The leaked data included personal banking information related to 7,300 individuals. Ransomware group 8Base claimed responsibility for the attack, declaring that its actions were for the greater good, prompting organizations to better safeguard private data. 8Base demanded a ransom payment to restore the data or it would publish the data if payment was not received. Should ADSC pay the ransom or not? What specific actions should it take to respond to the crisis and how should these be prioritized?