A ransomware attack on a medium-sized distributor’s ERP system has raised concerns about who is responsible for the damages. The attack occurred on a Saturday at 2:40 am, and the operation only resumed on Wednesday. The incident happened when a technician from the IT support company accessed the system using a shared administrative account without two-factor authentication.
Ransomware Attack Details
The account had been created by the distributor in 2022 and was used by three technicians. The password was the same one used by the technician in another client’s environment, which had been breached weeks earlier. Once inside the network, the attacker exploited a known vulnerability in the fiscal document system that the supplier had patched six months prior, but the update had not been applied.
Contractual Responsibilities
The distributor wants to hold the IT support company responsible, arguing that the credential was theirs. However, the IT support company claims that the account was created by the client without two-factor authentication and with privileges they had not requested. The supplier points out that they had notified the distributor of the patch via email.
Each party has some justification for their position, making it difficult to determine responsibility based solely on the forensic report. The question of who is responsible for the damages depends on the contractual agreements between the parties. According to Article 389 of the Brazilian Civil Code, the party that breaches a contract is liable for losses and damages (art. 389 of Law 10.406/02, the CC), covering what the other party actually lost and reasonably failed to profit, limited to the direct and immediate effect of the breach.
The contract between the distributor and the IT support company likely outlines the responsibilities of each party. If the contract is silent on certain issues, such as who creates accounts, defines privileges, or applies updates, the discussion may focus on what is expected of a diligent service provider and what the parties have practiced throughout their relationship, guided by the principle of good faith. Article 422 of the Brazilian Civil Code guides this principle.
When the contract addresses these issues, it tends to prevail. Article 421-A of the Brazilian Civil Code presumes business contracts are paritarian and symmetrical, mandating that the risk allocation defined by the parties be respected. A clause limiting the service provider’s liability to twelve monthly payments or excluding lost profits will generally be taken seriously by the judge, unless there is a discussion about its application to serious misconduct.
Shared Responsibilities and Liabilities
The IT support company administering the environment has a duty to notify the client in writing about the lack of two-factor authentication and propose corrections if the contract assigns them this responsibility. If they warned the client and the client refused to bear the cost, the record of this refusal weighs in favor of the IT support company.
Market references, such as the CIS Controls v8.1, suggest that a diligent service provider should include security requirements in contracts with service providers and ensure secure decommissioning at the end of the relationship. The NIST Cybersecurity Framework 2.0 also emphasizes defining security roles for providers and including these requirements in contracts.
Determining Liability Factors
In the case of the distributor, two factors contributed to the attack: the creation of a shared administrative account without two-factor authentication and the technician’s reuse of the password in another environment. Neither factor alone would have led to the attack. The Brazilian Civil Code guides the determination of indemnification, considering the gravity of the victim’s fault in relation to the author of the damage.
The division of responsibility will depend on who had the duty to require two-factor authentication. If the contract stated that the security of the accounts was the client’s responsibility and the IT support company only executed calls, the client’s fault weighs more. If the IT support company administered the environment with autonomy, the shared account and the absence of two-factor authentication become omissions on their part.
The reuse of passwords is negligence on the part of the technician in any scenario, and the IT support company is responsible to the client for the conduct of whoever they assign to perform the service. Control 6 of CIS Controls v8.1 (Center for Internet Security, 2024) requires MFA for all administrative access, including third-party managed assets (6.5), and annual privilege reviews (6.8).
Related Post: Brazil criminalizes bank account misuse
The position of the software supplier changes depending on who operates the system. If the system is delivered as a service in the cloud, the supplier administers the environment, and a known vulnerability without correction for six months is a breach of the obligation to maintain the service securely, with losses and damages limited to the contract.
If the system runs on the client’s server, the supplier fulfills their part by publishing the correction and communicating it; the installation is the responsibility of whoever administers the server. The unapplied correction tends to weigh on whoever administered the server, but the supplier is not automatically exempt: if the notice was sent to an outdated contact or did not indicate that the vulnerability was being exploited, there is room to discuss whether they fulfilled the duty to inform.
When the system handles personal data, the General Data Protection Law adds a criterion: the treatment is irregular when it does not provide the security that the holder can expect, considering the techniques available at the time. Article 44, III, of the General Data Protection Law (LGPD) states this principle.
Data Protection Responsibilities
In the event that the encrypted server contained personal data, there is a second layer of responsibility towards the data subjects. The distributor is the controller. The IT support company that accesses the database and generates the backup processes data on behalf of the distributor; the SaaS supplier also does. The ANPD’s Guiding Manual for definitions of data processing agents describes the operator as whoever processes data on behalf of the controller and can define non-essential elements of the treatment.
Towards the data subject, the operator is jointly and severally liable when they breach the obligations of the data protection legislation or do not follow the lawful instructions of the controller. The reuse of passwords by a technician with administrative access to the database violates the security duty of Article 46 of the General Data Protection Law.
Whoever indemnifies the data subject has recourse against the other responsible parties, to the extent of each one’s participation. The 2nd Panel of the Superior Court of Justice (STJ) decided in AREsp 2.130.619/SP that personal data leakage alone does not automatically generate compensable moral damage, requiring the data subject to prove harm, except for sensitive data.
If the distributor’s clients are consumers, the distributor is objectively liable towards them. Article 14 of the Consumer Protection Code states this principle. Between the distributor and the IT support company, the Brazilian Civil Code applies.
The burden of proof in civil proceedings lies with whoever alleges the facts that constitute their right. The distributor that claims the initial access used the IT support company’s credential needs the records of the remote access tool and the VPN; the IT support company that claims to have warned about two-factor authentication needs the call record.
Paragraph 1 of Article 373 of the Civil Procedure Code allows the judge to assign the burden of proof differently, by a reasoned decision, when one of the parties has greater ease in obtaining proof of the contrary fact. In disputes with IT service providers, this provision weighs heavily because the records usually belong to them.
If these records were deleted or overwritten during the restoration, the IT support company may be tasked with demonstrating what they would say. The same applies to the distributor regarding what was under their control. The ISO/IEC 27001:2022 provides for the definition of security in agreements with suppliers and the monitoring of services provided.
