By Kathy Ennis, CPA, Partner and Lena Combs, CPA, Partner

Ransomware is a type of cyberattack that can infect a system whenever a user interacts with a malicious link, website, or file. In a ransomware attack, the hacker encodes data that can only be retrieved by paying a ransom and obtaining the encryption key used for decoding. Ransomware attacks are continuing to rise at an alarming rate, with cybercriminals targeting businesses across virtually all industries. 

If you get infected by ransomware, follow these tips on how to recover from a ransomware attack:

1. Discover what kind of ransomware is attacking you – The best way to do this is to ascertain how much of your data you still have access to. There are two common types of ransomware, screen-locking and encryption-based, with each operating a little differently. Depending on the type of ransomware impacting you, there’s a chance that data recovery is still possible, and there may be a way to decode the encrypted files without having to pay the ransom. If you don’t have the internal resources to diagnose the type of ransomware you’ve been infected with, engage with a trusted cybersecurity firm for help.

2. Disconnect from everything – The most important thing you can do is restrict ransomware impact by disconnecting your device, turning off the Wi-Fi, and preventing the virus from spreading throughout the network.

3. Take a picture of the ransomware screen – When attacked, a note identifying the ransom will be displayed, including the amount to be paid and where to send the payment. Take a picture so the information is readily available for when the appropriate authorities are contacted.

4. Enact your incident response plan – If you have one, enact your incident response policy immediately because this is a security breach. Follow the measures defined in your policy to ensure that the proper steps are taken, including notifying stakeholders of the breach.

5. Attempt restoration from backups – If possible, you may want to restore your systems from any backups you have available. However, be cognizant that the ransomware may have been in your system for some time, so any backups could be compromised as well. Before restoring, make sure to deploy antivirus software through your system.

6. Prevent it from reoccurring – Put measures in place to prevent future attacks. Protect your network with a phishing assessment and phishing awareness training. Understand your threat intelligence with an Open Source Intelligence Report (OSINT) Dark Web scan, and analyze your data privacy risks with Data Privacy Assurance. Ensure that you have an independent cyber insurance policy and conduct a risk analysis.

A proactive approach is the best way for businesses to help prevent a ransomware attack. In the event of a cyberattack, it is important for companies to investigate and immediately mitigate any impacts.

Withum is a forward-thinking, technology-driven advisory and accounting firm, committed to helping clients in the hospitality industry be more profitable, efficient, and productive in the modern business landscape. For more information, visit www.withum.com 

While it always feels satisfying in the moment to receive gifts or do things for yourself, most people would agree helping others provides the ultimate gratification. This is why Gas South has built giving back into the core of our company and who we are, recognizing that everything we do should further our mission to “Be A Fuel For Good.” From a corporate level, we’ve seen the incredible impact this has had on our culture, so here is our three-step guide to giving back:

Identify a Cause

There are so many people that need help in the world, while we wish we could have an impact on everything and everyone, it simply isn’t possible. That’s why it’s important to identify a cause you are passionate about as a starting point. At Gas South, our “North Star” is helping children in need, which provides a clear focus and directive when seeking organizations to support.

Quantify Your Gift

When it comes to monetary contributions, create a benchmark or goal to dictate your impact. Considering how revenue can fluctuate, we recommend dedicating a consistent percentage of your annual profits to your cause. At Gas South, we pledge to share 5% of our annual profits with children in need, so everyone in the organization knows our commitment level to the community. We are incredibly proud to have given more than $7.5 million to our charitable partners since 2005.

Time is Money

Donating money is an important component of giving back, but when it comes to truly enriching your team, nothing beats the hands-on experience of helping others. Aligning your employees with the cause you are supporting will further connect them to each other and the community, so when deciding where to donate money, don’t forget to look for organizations that provide opportunities to volunteer and lend a literal helping hand to others. At Gas South, our employees have volunteered nearly 1,600 volunteer hours in the last two years alone.

Considering the challenges presented by COVID-19 over the past 18 months, there have never been as many people in need as there are right now. And while giving back is the moral thing to do, it also provides tangible benefits for individuals and the organizations that unite them. That’s why Gas South constantly strives to “Be A Fuel For Good,” and it is our sincere hope others follow our steps to success and get more engaged with the communities we all serve.

by Eric Shapiro

Cyber hacks are very much on the rise. What most people don’t understand is that hackers are usually not targeting any business specifically. Usually, they are using bots to troll the net looking for companies with weak security controls. Or they are sending out blast phishing emails hoping a naïve employee will click on a link or open a document that is infected with malware.  Or they are creating social engineering scams to try to dupe people into wiring funds to the wrong bank accounts. Because these efforts are widely distributed and many bad actors are doing this, all companies are vulnerable. There are things all companies can do to stay vigilant and try to protect themselves beyond the usual firewalls, VPNs, etc.:

1. Implement Multi Factor Authentication (MFA) – This should be used for anyone that can access your system remotely.
2. Implement End Point Detection – This will help your IT staff continually monitor and respond to cyber threats.
3. Train, Train, Train – Make sure your entire staff understands the threat and stays vigilant against opening the wrong attachments. Do phishing exercises regularly.
4. Put controls in place around Wire Transfers – Make sure anyone that has the ability to do wire transfers is trained to correctly, verbally, confirm the details of all wires.

Due to the increase in frequency and severity of cyber-attacks, Cyber Insurance has become more expensive and more difficult to get.  It’s also become much more important to have. Carriers are now requiring their insureds to have these controls in place before they will provide insurance. When completing the application for insurance pay close attention to the questions about controls and answer them honestly. If you do not have all these controls in place, you will probably be required to implement them so have a plan in place and articulate that. Work with your insurance agent to get the proper coverage based on your exposure. Terms and conditions vary widely in the marketplace so be very careful to make sure you get the best coverage you can. Remember, especially with cyber, you get what you pay for so don’t just buy on price.

Eric Shapiro is the Regional President for Socius Insurance.

Al Saikali
Chair, Privacy & Data Security Practice
Shook, Hardy & Bacon, LLP

Ransomware attacks have sucked billions of dollars from American companies. Not just in ransoms paid, but also in lost revenue, the costs incurred restoring systems and investigating the incident, and the cost of class action lawsuits that have followed when customer/employee personal information is impacted. This article addresses some of the most common questions about ransomware and provides suggestions on ways to mitigate that risk.

What Is A Ransomware Attack?

Ransomware is a form of malware that encrypts (locks) your data and prevents access unless you unlock the data with a decryption key. There are three stages to a ransomware attack.

In the first stage, the threat actor (“the bad guy”) exploits an existing weakness (vulnerability) in your network. This vulnerability could be an open remote desktop protocol port, an employee who clicks on a phishing link, or unpatched software for an application or server/firewall. This stage gives the threat actor a foothold in your organization.

In the second stage of the attack, the threat actor performs reconnaissance in your network to identify and often exfiltrate/steal your data.

In the third stage, the threat actor deploys the ransomware that begins encrypting your files.  Without effective monitoring tools, all you will see is the end result when you turn on your computer, cannot access files because they’re encrypted, and find a ransom note threatening to release the stolen data on the dark web unless you pay a ransom.

The analogy I like to give clients is to imagine if you were to leave your house for the weekend but your front door and a couple of windows are unlocked.  Those unlocked doors/windows are your vulnerabilities. A burglar will test your doors and windows until he finds an unlocked one and uses it to access your house (i.e., exploit your vulnerability). Once inside, he will perform reconnaissance – looking around your house to find where your valuable items are hidden – and he will steal (exfiltrate) some of your items in the process. Imagine if, before the burglar leaves your house, he goes around changing all the locks so you can no longer access your house. When you return home you realize your key doesn’t work anymore. You see a note on your front door that says, “If you want to re-enter your house you must pay me $5,000,000 in Bitcoin; and I stole your valuable/sensitive items, so unless you pay me in the next 72 hours I will sell everything I stole on the Dark Web.”  That is essentially a ransomware attack.

What To Expect When Under Attack?

When you are under attack, you can expect to lose access to critical functions as the encryption spreads like a virus throughout your connected network. Your access will be down for at least a few days and potentially even a few weeks. You will receive questions from employees, customers, business partners, and the media asking what is happening. You should expect to spend tens or hundreds of thousands of dollars, at minimum, responding to the incident. The good news is there are steps you can take to mitigate these risks.

Responding To The Attack

Like a boxer punched in the face by Mike Tyson, you will initially panic and be stunned when you first realize you are under attack. Try to set aside the panic (and the pain) to focus on some key initial steps that will help you recover:

• Contact your cyber insurance carrier immediately. The carrier will provide you with experts who can help restore your data, contain and eliminate the threat, identify and fix the vulnerability, negotiate with the threat actors (even if you need to buy more time), and advise you on your legal obligations.
• Do not erase anything and do not provide the only copies of your servers/workstations to third parties. These devices hold important information about the nature of the attack that the forensic firm will need to help you recover.
• Begin the process of restoring your information from backup.
• Operationally, you may need to start using an alternative method of communication while the recovery and remediation efforts are underway. You may also need to use a backup method of doing business, whether that is old-fashioned paper and pen or using personal laptops. (By the way, the lesson here is not “you’re better off just doing business the old-fashioned way with paper and pen” – that method may avoid a ransomware attack but it creates much larger data breach and security issues.)
• Work with your newly engaged cybersecurity experts to contain the threat, close the vulnerability, and identify which files may have been stolen or accessed.
• Your legal counsel will ensure you are: (a) meeting legal requirements to preserve certain evidence; (b) performing the forensic investigation under privilege; (c) issuing statements to employees, customers, and business partners that don’t create additional liability; (d) notifying the right law enforcement entities; and (d) notifying third-parties and customers whose data may be impacted in the manner required by law.

Are You Allowed To Pay A Ransom? 

There are instances where paying a ransom may be necessary. For example, where data your organization needs to survive has been encrypted and you cannot restore your system using your backup files (either because the backup files were also impacted or because they don’t exist). Another example is where sensitive customer data has been stolen and there is a threat to release that data on the dark web.

An initial question is whether the threat actors will actually provide the decryption key or delete the stolen data if they are paid the ransom.  Usually, yes. Their business model does not work unless they do.

So when is it illegal to pay a ransom? The law prohibits transactions that directly or indirectly benefit certain individuals/terrorist organizations on a list maintained by the Department of Treasury’s Office of Foreign Assets Control (OFAC). You cannot pay anyone on that list, and doing so may result in criminal and civil penalties. If you decide to make a ransom payment, the company you hire to facilitate that payment will first perform an “OFAC check” to ensure the payment you are about to make is not being made to an entity on that list.

Who Do I Need To Notify About The Attack?

If the threat actor accessed certain sensitive information (e.g., customer/employee personal information, or proprietary/sensitive information of business partners) there may be a legal obligation to notify those third parties whose information is impacted. There may also be an obligation to notify state attorneys general or other regulatory authorities. In some instances, your contracts with business partners may require that you notify them even if there is no proof that their information has been impacted. Your lawyer should be guiding you on these obligations, the timing of notice, and the content of that notice.

But even if there were no legal obligation to notify, you may want to consider providing an informal update to customers and business partners about what is happening. If you decide to do this, it is incredibly important to work with legal counsel on this messaging because one wrong word could create a potential negligent misrepresentation or deceptive trade practice claims.

The Risk of Class Action Lawsuits and Regulatory Enforcement Actions

Unfortunately, we live in a litigious society driven by individuals who are incentivized to file lawsuits against victims of a cyberattack. When you notify customers/employees that their information was impacted by the ransomware attack, there is a good chance that a plaintiff’s lawyer will learn about the attack from the news, from your regulatory notification, from a statement on your website, or from an individual who received notice and has questions about it. Increasingly, those lawyers are filing class action lawsuits against companies that are victims of cyberattacks. They use social media to find potential clients “impacted by the XYZ data breach.” These lawsuits are usually looking for a quick settlement where each impacted person perhaps receives very little, but the lawyers receive hundreds of thousands of dollars in attorney’s fees.

There is also a lower risk that the Office of the Florida Attorney General will seek penalties against your business for: (a) failing to adopt reasonable security safeguards to protect sensitive consumer information; (b) taking too long to notify impacted consumers; or (c) making statements about the incident that were not accurate. This is why incident response preparation is as important to minimizing costs as the response itself.

How To Mitigate The Risks

The good news is that there are steps your organization can take to minimize the likelihood of an attack and the impact of such an attack.  From a technical perspective, one such measure is implementing multifactor authentication on any application, remote access protocols, email, or other sensitive information.

• Multifactor authentication requires you to authenticate yourself in more than one way (e.g., something you know, like a password, and something you have, like a phone where you receive a text with a short code).
• Ensure you are backing up your information securely, from an offline source that is not connected to your network.
• Purchase cyber insurance. A cyber policy typically covers most costs you will incur when responding to a ransomware attack, including legal counsel, forensic experts, data restoration services, certain operational losses, and sometimes cyber-extortion costs (threat-actor negotiation services and payment of a ransom). It also typically covers the costs associated with class action lawsuits and regulatory enforcement actions.
• Prepare an incident response plan, which is your roadmap for what to do if you ever fall victim to a cyberattack. The document describes who would need to be involved (internally and externally) and what steps to consider on operational, security, legal, and financial issues.
• It is not enough just to have a plan; you need to test it. The individuals who would be involved in responding to a cyberattack should meet at least annually to walk through a simulated attack. You can hire a third-party cybersecurity firm or a good lawyer to moderate this exercise.
• Perform cybersecurity training for all levels of employees/directors/owners of your company at least once each year.
• Deploy endpoint-monitoring tools that are constantly searching for unusual behavior and malware on your network.
• Minimize the amount of sensitive data you collect. If you do not need it, don’t collect/keep it. If you really need it, encrypt it.
• Engage a third-party cybersecurity firm to assess your environment. Let them identify your vulnerabilities (unlocked doors/windows) and prioritize which ones you should fix in which order. Florida has some outstanding cybersecurity firms that can help you do this.

Conclusion

There are other security measures you can and should implement. Working with a third-party cybersecurity expert and legal counsel experienced in cybersecurity will help you identify which of those measures are right for your organization, and how to prioritize implementing them.

Al Saikali chairs the Privacy and Cybersecurity Practice at the law firm of Shook, Hardy & Bacon, LLP. He and his team regularly represent companies in preparing for and responding to cybersecurity attacks. If you have questions, you may contact Al at [email protected].