As computers have grown in processing power and functionality over time, so has malware.
Malware attacks have become so sophisticated that hackers now employ ransomware. This type of malware can lock victims’ computers behind encryption and copy any sensitive information on affected systems simultaneously. The cyber attackers can then hold the infected computers and stolen data hostage until the victim pays a ransom.
Introducing ransomware into a computer system is a crime in Texas. However, it’s only considered a misdemeanor offense if the amount involved in a ransomware incident is less than $2,500.
But when does it become a felony?
Ransomware with high losses leads to a felony charge
A ransomware attack with an aggregate amount above $2,500 is a felony, per Texas law. The aggregate amount includes any direct or indirect loss incurred by the victim due to the attack (i.e., money stolen, the ransom paid, business losses, etc.) plus any expenses the victim spent to restore their affected systems.
The criminal degree further increases the more money is involved in the offense:
- Aggregate amount is more than or equal to $2,500, less than $30,000: The offense becomes a state jail felony, which carries up to two years of confinement in a state jail on conviction.
- Aggregate amount is more than or equal to $30,000, less than $150,000: The offense becomes a felony of the third degree, which carries a maximum 10-year prison sentence.
- Aggregate amount is more than or equal to $150,000, less than $300,000: The offense becomes a felony of the second degree, which carries a maximum 20-year prison sentence.
- Aggregate amount is more than or equal to $300,000: The offense becomes a felony of the first degree, the highest possible penalty. It carries a life sentence or up to 99 years of prison time.
Aside from causing heavy economic losses, there’s another way for a ransomware attack to be charged as a felony.
Restricting privileged information is a felony
If prosecutors show that the accused person restricted a victim’s access to privileged information during trial, the offense counts as a felony. This “privileged information” includes protected health information and confidential information shared by attorneys or accountants with their clients.
Even if a ransomware incident leads to an aggregate amount of less than $2,500, officials can charge a suspected person with a state jail felony if privileged information is involved. Likewise, it only takes a ransomware incident with an aggregate amount of $150,000 or more for a person to face a first-degree felony charge.
Ransomware, no matter the scale of the cyberattack, is a punishable offense. The more economic damage a ransomware attack inflicts, the graver the offense. If the cyberattack also cripples computer systems that handle privileged information, a felony conviction awaits the accused. Those charged with the offense should carefully consider their legal options because they could serve years in prison.
