Bill > SB415

This bill introduces comprehensive legislation addressing ransomware offenses in Pennsylvania, creating a new legal framework to combat cyber extortion. The bill defines ransomware as a computer contaminant that restricts access to computer systems or transforms data into an unreadable form while demanding payment for restoration, and establishes strict prohibitions against possessing, using, selling, transferring, or developing ransomware with criminal intent. The legislation outlines graduated criminal penalties based on the monetary value of the extortion attempt, ranging from misdemeanors to felonies, with increased severity for repeat offenses or attacks involving physical injury or targeting judicial system computers. The bill mandates that managed service providers and Commonwealth agencies promptly notify law enforcement about ransomware incidents, requires the Office of Administration to conduct an annual study on ransomware preparedness, and prohibits the use of public funds to pay ransomware extortion demands after December 31, 2025. Additionally, the bill allows victims to pursue civil actions to recover damages and provides legal mechanisms for system recovery, forensic investigation, and protection against future attacks. The legislation aims to strengthen cybersecurity capabilities, provide clear guidelines for responding to ransomware threats, and establish a comprehensive approach to preventing and prosecuting these increasingly common cyber crimes.

Justice

https://www.legis.state.pa.us/cfdocs/billinfo/bill_history.cfm?syear=2025&sind=0&body=S&type=B&bn=415