Attack by Hackers and How It Affects Taxation
Recent claims of a significant hacking assault that hit multiple university websites have been making the news. Crypto ransomware was used in the assault, which is thought to have been conducted by hackers from many regions of the world.
The Taxpayer Company’s Situation
Recently, a business that had been the target of crypto ransomware discovered itself in an unusual situation with regard to tax ramifications. The corporation sought the Italian tax authorities (Agenzia delle Entrate) to ask about the deductibility of the ransom paid after being compelled to pay a substantial ransom to recover control of its crucial business data. The business claimed that the ransom shouldn’t be included in its taxable revenue.
The tax authorities (IRS), who disagreed with the company’s claims, ruled that the ransom payment could not be subtracted from the company’s taxable income, which establishes the basis for forming the taxable base.
Crypto Ransomware and Taxation
The deduction of expenses incurred in committing crimes, including intentional acts, is prohibited by Italian law. This restriction, however, only covers the expenses related to committing the offense. Due to later laws that changed its aim, this exclusion’s applicability is restricted.
As a result, responsible crimes are exempt from the ban on expense deductions, which only applies to intentional offenses. In addition, the restriction cannot be enforced unless the prosecution has already begun, a court has issued an indictment, or the statute of limitations has barred prosecution. The taxpayer is entitled to a reimbursement of any taxes paid as a result of the non-deduction of such costs if the accused is found not guilty. If the accused is found not guilty, the ban from deducting costs is lifted.
Why the Tax Agency Refuse to Allow Ransom Costs to Be Deducted
Because there is insufficient proof that the expenditures expended are connected to acts that lead to the generation of income, the tax authority rejects the deductibility of ransom charges. According to the tax authorities, it is the taxpayer’s duty to substantiate that the expenses spent are directly connected to the economic activity engaged in.
Even if the taxpayer reports the incident to the police, this may not be enough to establish a link between the extortion experienced, its effects on the company, and the expenditures expended. It is advised to meticulously and promptly record the facts and the direct link between the extortion endured, the impact on the business, and the expenditures paid in order to reduce the danger of having to pay taxes on the ransom and to improve the chances of deductibility. This evidence may be presented in a number of ways, including screenshots of the hackers’ messages, expert assessments from digital forensics professionals, or a report submitted to the appropriate judicial or law enforcement authorities.
The burden of evidence has been set high by the Italian tax authorities, therefore it is important to seek the advice of qualified experts when determining how to best establish the truth and the functional relationship between the expenses incurred and the business activity engaged in.