It is Monday morning and you open your laptop to start the week. But instead of your familiar workspace, a message appears on your screen: “All your files have been encrypted. Pay €50,000 in Bitcoin, or everything stays unusable.” You try to open files, but nothing works. Your whole organisation is at a standstill.
That is ransomware. In The Digital Compass we explain how such an attack unfolds and what you can do about it.
How did this happen?
The attack may have started innocently. Last week an employee clicked on an email that looked like an invoice from a supplier. Or someone visited a hacked website without knowing it. Within seconds, malicious software installed itself unnoticed and spread through the network.
In the background, the criminals did their work. First they encrypted your files: customer data, quotes, the financial records. They may even have infected your backups, so restoring is no longer an option.
Double extortion
Some attackers go a step further. They do not just encrypt your files, they also steal sensitive data, such as customer information, personnel files and contracts. If you do not pay, they threaten to publish everything. Customers find their personal data on the dark web, competitors gain insight into your strategy, and your reputation takes a serious hit.
What criminals really want
Cybercriminals are not lone hackers in hoodies. They are organised gangs, sometimes with hundreds of staff, clear business models and even a customer service desk. Cybercrime is big business, and your data is worth money:
- Reselling: stolen customer data and passwords end up on the dark web, where others buy them to log in, intercept invoices or break in further.
- Identity fraud: orders are placed or contracts signed in your organisation’s name.
- Selling access: sometimes criminals do not use your network themselves, but sell the access on. Someone else then strikes with ransomware.
- Abusing your email: thousands of phishing emails go out in your name. Your contacts get fake payment requests, and your domain ends up on a blacklist.
Do not think: “I have a backup, so I am safe”
Criminals know that organisations make backups. So they try to encrypt or destroy those too. Without a good plan, with preventive measures and regular backup checks, you are vulnerable. And a backup helps you get back to work, but does not stop stolen data from being published. How to set up backups properly, you can read in Backups: why OneDrive is not a backup.
What you can do today
- Make getting in hard. Two-step verification on all important accounts and unique passwords in a password manager.
- Close the back door. Let software update automatically and stop using outdated software that no longer gets updates. More in Software updates: take control.
- Limit the damage. Do not work with admin rights by default. Then one click cannot open up your whole environment. Read why nobody should work with admin rights by default.
- Have a plan B. Automatic backups, at least one offline, encrypted, and tested regularly.
- Be prepared. Know who to call and what to do first if things go wrong. A good incident plan limits the damage and gets you running again sooner.
- Make sure someone is watching. The sooner an attack is spotted, the smaller the damage. Day and night monitoring is part of Cyber Resilience.
More in The Digital Compass
This article is based on the first edition of The Digital Compass (in Dutch). It also includes a checklist to assess how secure your organisation is.
