0

Our client had all their files encrypted through ransomware. They are negotiating payment of half a million dollars to retrieve data. It will take a month.

They lost all their digital utility system maps for the time being. We seem to have no choice but delay work, as we need information from them before continuing.

In the meantime how can we help them move forward with Engineering projects?

  • 10
    This is not a workplace question – Victor S Aug 15 '19 at 14:23
  • 6
    Beyond the fact that this is a fairly technical one, even a general answer will depend on the specific industry and methodology. – Fábio Dias Aug 15 '19 at 14:27
  • 5
    @VictorS It is indeed a valid workplace question. Basically the OP is saying that his company depends on data from a third party that is now unavailable. What can they do? – Dan Aug 15 '19 at 14:46
  • 13
    Make plans to NEVER get that data back. According to the FBI, only 40% of people who pay the ransom ever get any data back. Depending on contract terms this may even allow/force your client to terminate your services. You need a contingency plan right now for both scenarios. – Wesley Long Aug 15 '19 at 15:28
  • 2
    @IDDQD Recently a city in USA paid a ransom demand that held their emergency/police/fire data hostage. It was 600k and the city council had to approve it. Very doubtful you'd get into trouble for that if the government itself pays into the ransom. That's victim blaming to the max and it would never hold up in court. It would also deter anyone from reporting that they were attacked and it would appear that ransomware attacks are less when it's not. It would encourage criminals because they know you won't report it and they can demand more money. – Dan Aug 16 '19 at 12:58
5

None of the posted answers actually solve the clients problem. Whether the client has the data backed up or not is irrelevant. They already have a solution for that.

I would advise to find a third-party API utility mapping service that they can use. Try googling 'digital utility system maps api' or similar. Hit the API service to pull map data and provide the mapping solution in the mean time until the maps have been recovered.

Here is a link to an API that provides mapping data for various industries. I have seen it used in Real Estate and Construction Projects. ArcGIS Mapping API

9

It's disheartening to see yet another company that doesn't have current and validated backups of their data. I'm assuming this company doesn't, otherwise you wouldn't be asking the question. If they don't have current and validated backups of their data then they really only have a few choices:

  1. Pay the ransom and hope that they can decrypt/recover the data.

  2. Don't pay the ransom and hope that they can "reconstruct" what they need in order to continue serving their clients and stay in business.

In either case, they should be reaching out to local law enforcement agencies to determine what legal steps they can take. This won't get them their data back, but it's important that they involve law enforcement in this.

  • 7
    Plus 1 for current validated backups... Why don't people or companies think... Stable door and horse come to mind. – Solar Mike Aug 15 '19 at 15:55
  • In addition to backups, it is a good idea to keep logs or paperwork that will allow reconstruction of transactions since the last clean backup. – Patricia Shanahan Aug 15 '19 at 16:27
  • 3
    -1 for not answering the question. OP isn't in position to decide about the payment, it's his client. – Chris Aug 16 '19 at 18:09
  • 2
    @Chris I did answer the question. Additionally, I didn't say they should or shouldn't pay the ransom. I said they had two choices: pay it or not pay it. It's their decision. I merely stated the choices they have available. – joeqwerty Aug 16 '19 at 19:06
  • 1
    @Chris, what are you after exactly? I'm failing to understand what you're trying to get at. My answer addresses the question. How can we help them move forward with Engineering projects? - 1. Pay the ransom and hope that they can decrypt/recover the data. 2. Don't pay the ransom and hope that they can "reconstruct" what they need in order to continue serving their clients and stay in business." - That's how the OP can help the client move forward. Those are the only two choices. – joeqwerty Aug 16 '19 at 20:43
2

I assume the client has already assessed the financial and legal impact of the attack and the effect on the client's customers.

Assume for now that you don't get that recent data back. You might do, but don't assume a thing.

The first port of call is to engage the services of consultants to help the client through this process. There's been more than a few companies affected by this situation, and there is professional help and guidance out there. It'll be expensive, but worth more than the help of random people on the internet.

Your client did have regular backups that were physically separated from the main data stores, didn't they?

  • 3
    If they had current complete backups then they would not need to ask the question... – Solar Mike Aug 15 '19 at 15:56
-2

Generally: do NOT pay. The criminals are as likely to just take the money and run, or use the "key" to install more backdoors for future attacks.

Get a good team of engineers in place to purge the entire network of any malware, which probably means completely wiping and reinstalling every single computer (from workstations to servers, including (even especially) those of senior management, board members, etc.).

And fingers crossed they have good backups so they don't lose too much data...

And, obviously, take this as a very serious warning and get much stricter data protection policies, network security, workstation security, and user awareness in place.

  • 2
    "in the meantime", the OP isn't asking what to do wrt the attack, but what to do while they solve that. I do agree with the "take as a warning" tho. – Fábio Dias Aug 15 '19 at 14:05
  • 2
    Agreed that it is a bad idea to pay the ransom. Many companies do not take the warning to back their data up on a secondary system that isn't connected. Hopefully the company will implement a better system but what can the OP do in the meantime? – Dan Aug 15 '19 at 14:22
  • 2
    I disagree that the criminals are likely to just take the money & run. Doing so would hurt their "business model" since they'd end up building a "reputation" for being untrustworthy - resulting in fewer victims paying the ransom. It makes much more sense, once they have their victim by the short & curlies, to play nice - since this would maximize their longer term revenue. – brhans Aug 15 '19 at 16:59
  • 1
    @brhans $500,000 is a small fortune. Maybe the criminals can afford to destroy their "business" over a one-time success of that magnitude. – Southpaw Hare Aug 15 '19 at 18:32
  • 1
    @brhans as they can easily use a different name and stuff for every victim, their "good name" (what does that even mean when it comes to criminals) is irrelevant. You're advocating to trust criminals, and yes to pay the ransom because if they're to be trusted it's the quickest way out of the mess the victim is in and thus the sensible business decision. – jwenting Aug 16 '19 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy