A 51-page Senate committee report warns that the US government lacks comprehensive data on ransomware attacks and payments and suffers from fragmented reporting
Liam Tung / ZDNet : Source: Homeland Security and Governmental Affairs Committee .
Context & Ripple Effects
This report extends a pattern the Senate itself documented a year earlier, when a [[a:969279|bipartisan investigation found many federal agencies still lacked effective cybersecurity programs]] despite repeated warnings. The Governmental Affairs Committee's new finding shifts the critique from agency defenses to the government's own visibility: without comprehensive data on attacks and payments, policymakers cannot measure whether any of the counter-ransomware push since 2021 has worked.
First-order effects
- Lawmakers drafting ransomware legislation now lack a baseline: fragmented reporting means Congress cannot quantify attack volumes or payment flows, weakening the case for mandates over voluntary disclosure.
Second-order effects
- The gap undercuts commitments made at the White House ransomware summit, where 32 countries pledged to share cyberattack information — international coordination depends on national data the US cannot fully supply.
Third-order effects
- If unmeasured ransomware persists, expect the same verdict abroad: the UK parliament's warning of vulnerability to a catastrophic ransomware attack shows allied governments converging on the conclusion that reporting failures, not just attacker capability, define the risk.
The trend: Western governments are moving from pledging collective action against ransomware toward confronting their own inability to measure it, making mandatory incident-reporting regimes the likely next battleground.