The ongoing costs of a ransomware attack

We have previously reported on the SamSam ransomware attack on the City of Atlanta (initial report and a follow-up report on the costs of recovery). Recent media reporting has revealed that video files containing police dashcam footage were encrypted during the attack and cannot be recovered.

It is concerning that important policing processes such as evidence gathering, or even decisions around guilt and innocence, could potentially be impacted by a ransomware outbreak. Backing-up these video files to a secure location would have negated the impact of their loss.

We previously reported that the ransom demand amounted to around $55,000 and that the recovery costs were $2.66m. However, more recent reporting suggests that the recovery costs have exceeded $5m and that a further $9.5m has been requested for ongoing remediation costs.

While it may seem tempting to pay the ransom in such circumstances, victims should note that there is no guarantee that paying the ransom will enable the recovery of the files. Some ransomware variants do not have the ability to allow for the decryption of the files. Victim organisations should also note that whatever vulnerability was exploited to enable the attack will still need to be resolved, and that anyone who pays a ransom will be an attractive target for further attacks by the same or other groups.

The costs and effort of hardening your systems against a ransomware attack are multiplied if the work has to be undertaken during a crisis. It is worth remembering that ransomware is only a viable activity for organised criminals if victims pay the ransom.

The NCSC has issued guidance on mitigating ransomware and other forms of malware