Good news for ransom payment reimbursement

The tide may be turning for ransom payment reimbursement according to Andrew McCoomb, litigation partner at Norton Rose Fulbright.

Andrew McCoomb, partner, Norton Rose Fulbright

For businesses smacked with a cyber attack, paying a ransom largely means never seeing that money again. But in a recent LinkedIn post McCoomb outlined how he, and Norton Rose Fulbright litigation associate Tyler Morrison this week obtained an order for relief from forfeiture for Bitcoin (BTC) reimbursement to be paid to an insurer client.

The client in question paid 11.26024682 BTC ($371,857.60) to high-profile NetWalker affiliate ransomware perpetrator Sebastien Vachon-Desjardins, said McCoomb.

Vachon-Desjardins pleaded guilty to five counts of offences involving extortion, theft of computer data, cryptocurrency ransom payments and criminal organisation activity.  

According to the Ontario Court of Justice, "The Defendant personally profited greatly from these offences; he earned the equivalent of over $600,000 in cash (seized by police), bank balances of over $400,000, and Bitcoin transfers to money spent estimated at $1,755,000, and the value of at least 944 Bitcoins (720 seized and 224 paid in the days leading up to the seizure to invest in NetWalker), worth over $30,000,000 when seized."

Authorities seized over 680 BTC ($22,456,272.40) and $700,000 cash upon his arrest.

“At sentencing, the judge made orders for restitution for a small number of victims covering a small portion of the assets seized. But the criminal code doesn't provide for any exhaustive claims process, and only some victims were given an opportunity to seek to recover restitution,” said McCoomb.

“We had to apply for relief from forfeiture to prevent the assets from defaulting into the hands of the Crown, which they would have done 30 days after sentencing.”

McCoomb and Morrison managed to secure an order to provide reimbursement for the loss of seized property.

“There are going to be more arrests in this space going forward, and more opportunities for recovery, but it is the squeaky wheels that will get this grease - insured parties need to make sure they tell their insurers about opportunities for restitution, and insurers have to insist that they get a seat at the table when it comes time to apply for recovery,” said McCoomb.

“It is very much a self-help landscape. But we were very grateful to have a hand in establishing a significant recovery in what looks to be a case of first impression in the space.”

McCoomb told Digital Nation Australia that he gives "full credit" to law enforcement and the Ontario Ministry of the Attorney General.

"The biggest hurdle in these cases is always going to be apprehension and conviction and our authorities nailed it here," he said.