UNITED FACE £15m FINE IF THEY PAY HACKERS

MANCHESTER UNITED face a fine of up to £15million if they give in to the demands of cyber hackers holding the club to ransom. The ‘double-whammy’ threat emerged yesterday as United continued to fight the attack that has crippled the club’s systems for more than a week, as revealed by Sportsmail. United are already faced with a ransom demand believed to run into millions of pounds — or risk highly-sensitive information being leaked into the public domain. However, if they pay the hackers to call off the attack, United could fall foul of new US legislation punishable by a fine of up to £15m. Although United are a UK-based company, the Glazer-owned club are listed on the New York Stock Exchange and subject to US law. Their share price dropped yesterday. The US Treasury Department announced last month that any organisations meeting the ransom demands of hackers who appear on their global hit list risk incurring a financial penalty — even if the victims are not aware of the criminals’ identity. The US Office of Foreign Assets Control warned that paying the ransom would only boost the criminals’ finances and encourage them to strike again elsewhere. The OFAC statement read: ‘Companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations. ‘Facilitating a ransomware payment that is demanded as a result of cyber activities may enable criminals and adversaries with a sanctions nexus to profit and advance their illicit aims. Payments may also embolden cyber actors to engage in future attacks.’ The threat of a US fine for United is in addition to the threat of a penalty of up to £18m from the independent UK Government body, Information Commissioner’s Office, if the data protection of their huge fanbase has been breached — although the club are not aware that it has.