We recently helped an Augusta-area farm retailer recover from a $500,000 ransomware attack that led to employee salary and social security numbers being published online.
This case study proves that having a VPN and firewall doesn’t guarantee your network is secure.
The retailer was using a VPN with a firewall. However, the firewall was out of date and had known vulnerabilities. In other words, there were patches available that would have protected from this attack.
Their IT manager was overwhelmed, wearing many other hats. Nobody was really monitoring their systems. The company was an internet and phone client of ours but did not see the value of managed services even though we had told them their systems were vulnerable.
Hackers were able to access the VPN and steal the IT manager’s credentials. Using these stolen admin credentials, the hackers pushed out a ransomware package to all seven of the retailer’s locations.
The ransomware copied files—particularly financial data—and then encrypted all the computers. The hackers emailed the data to the retailer, demanding $500,000 to prevent the release of salary information.
All 150 of their desktop computers were shut down across seven locations, four servers and the VPN were compromised, their backup disks failed, they lost the 30 days of emails, and their website was taken down.
We worked all night to get very basic services going at their headquarters before the next morning. We had them up and (mostly) running within a week.
The retailer never paid the ransom, but it took three months to get systems fully back online. They experienced lost income and lost trust with employees and customers. But without ongoing management of their network security, they will soon be vulnerable again.
We don’t promoted managed IT services just because it’s good for our business. It’s good for every business.