Quarter Two Report 2019

Ransomware incidents have remained steady since CERT NZ launched in 2017, making up 2-3% of total reports received. In quarter two, we received 22 ransomware reports, mostly from businesses.

Ransomware is a type of malicious software that can get into a computer system in a number of ways, like a bad link or attachment in an email, or through out-of-date software. Once the ransomware has infected the computer, it encrypts files so they can’t be read or accessed, and demands money to recover them.

CERT NZ does not recommend paying the ransom. Although it may seem like the quickest solution to recovering files, the payment does not guarantee that they’ll be returned or decrypted.

Paying the ransom could also lead to further attacks, and further financial loss.

We’ve seen a number of ransomware campaigns impacting New Zealanders. One of the first was WannaCry, which exploited Microsoft systems. More recently, the wide-spread GandCrab, which reportedly infected over 1.5 million computers globally, impacting public services and disrupting the lives of many people.

Over time, attackers modify ransomware and release new variants. New types of ransomware are released to exploit newly identified software vulnerabilities. CERT NZ predicts that ransomware will be released to take advantage of Windows 7 when support for this operating system ends in January 2020.

The total direct financial loss from ransomware reported to CERT NZ is just over $127, 000, mostly from ransoms being paid. The costs of ransomware also go beyond direct financial loss. Cases we have seen report losses like reputation, data, and customer information. Of the total 160 ransomware incidents reported, over 70% reported one or more of these loss types.

Recovering from the impact of these attacks can be time consuming and significantly affect a business’s day-to-day operations. However, there are simple prevention measures CERT NZ recommends to help protect against a ransomware attack.

Tip: Protect your business from ransomware

• Keep your operating system and apps up-to-date. You can set this up to happen automatically with major operating systems like Windows and MacOS, and common applications like Office.
• Make sure you back up your files regularly to an external hard drive or cloud service. This includes the files on your computers, phones and any other devices.
• Install antivirus software and update it regularly.

A gym with close to 1,000 clients was hit by a ransomware attack. The manager had purchased new gym equipment and soon after received an email claiming there was an outstanding invoice with a PDF invoice attached.

The manager thought the invoice was a mix up for the recent purchase and tried to open the attached PDF. Nothing happened, so he tried again. Thinking the download issue was a fault with the computer, he carried on with other work. When he went back to the computer, all files were locked and a ransom pop-up appeared demanding payment to unlock them.

The manager immediately called his IT service provider and took the advice not to pay the ransom.

The IT provider identified that the PDF was a ransomware file that had infected the computer when it had been clicked on. All files had been encrypted with Locky ransomware and unfortunately couldn’t be recovered.

The gym had been in business for ten years, and had not backed up any data. As a result client records and fitness programmes were lost. With the significant loss of customer information, the gym also faced a reputational risk. The manager let all clients know of the incident and that their files had been lost. Fortunately, the clients appreciated the open communication and the difficulty of the situation.

To recover, the gym had to start from scratch to rebuild records while maintaining day-to-day operations, costing a lot of staff time and resources.

The gym is now following CERT NZ advice and taking steps to secure their systems by backing up all data regularly, and installing anti-virus software.

Backups for your business