Your data has been kidnapped… now what?

What’s it like to be held hostage? I never want to find out and I’ll bet you don’t either.  But given today’s environment executives might find themselves held hostage in a way they never expected. Ransomware, as it is known because it holds your entire computer system hostage, is quickly becoming the hacker’s method of choice because it’s simple, fast and virtually untraceable. 

For the most part companies that are victims have little choice (unless they’re properly prepared – more on that later) than to pay the ransom, whatever it is, to alleviate the attack. In fact, up until very recently even the FBI has recommended to victims that they pay up. 

Ransomware attacks are different than what most people perceive as a cyberattack.  There’s no theft of data or interest in stealing personal identification. Hackers don’t care if your company stores credit card information, medical records, login credentials or Social Security numbers. Instead, ransomware attacks leverage the importance of your business operation and access to your data, or what your computers control, to force you to pay up. And it happens. A lot. 

In fact, it’s becoming so ubiquitous that the CyberThreat Alliance estimates that they’ve seen 406,887 instances of just one type of “infection” and that the damage last year alone was $325 million. And that’s a soft number because it doesn’t calculate the damage from lost time, productivity and reputation. $325 million is just what you can put your finger on. 

So how does this work and why is it so effective? Simple: An email containing a link, attachment or embedded virus is sent to someone – anyone – in your organization. It might appear to come from the CEO, or from a large bank or credit card company. Using standard “phishing” techniques they’re bound to get at least one sucker to open the attachment and that’s all it takes. Once they open the email and click the link your entire organization could be held hostage for a ransom. What happens is that by clicking the link or downloading the file they’ve installed a piece of nefarious code that hackers will then use to encrypt your entire system with a key that only they have. But maybe not right away.