Digital data hijacking is a major threat to businesses

In recent years, ransomware attacks have become one of the biggest cyber threats for companies in Brazil and worldwide. Against this backdrop, digital law expert lawyer Gabriel Araujo Souto, from PG Advogados, explains the essential legal steps that companies and professionals should take when victims of this type of crime.

“The first mistake that many companies make is to act without specialized legal advice”, warns the lawyer. According to him, the rush to recover the data leads many organizations to make hasty decisions that can aggravate the legal situation. “Ransom payment, for example, is not a crime in Brazil, but needs to be analyzed with caution, as it can bring ethical and legal implications”, he explains.

The expert highlights three legal measures needed after an attack:

1.   Preservation of evidence ''Disconnecting affected systems without technical guidance may destroy important evidence for investigations;

2.   Notification to authorities (General Law on the Protection of Personal Data) requires communication to the ANPD (National Data Protection Authority ) within 72 hours when personal data is leaked;

3.   Contractual analysis . It is essential to verify obligations with customers and suppliers on data protection.

For prevention, Souto recommends that companies include specific cybersecurity clauses in contracts with IT vendors; develop an incident response plan aligned with legal requirements; and conduct periodic audits to verify compliance with data protection standards.

The legal aspect of digital security is often overlooked until it is too late.Preventive advice can prevent not only the damage of the attack itself, but also the legal consequences that can persist for years”, concludes the expert.