A Wake-Up Call for Cyber Security: A Real-World Ransomware Incident

Contents

1. Do you know your vendor’s vendor?
2. Impact
3. Prevention
4. Proteon to the rescue

Do you know your vendor’s vendor?

It’s a scary thought, but it’s true: no one is safe in terms of cyber security. Any company could become a target, including us or our suppliers, in an almost brilliant and unexpected way. And that’s what just happened!

In the second week of June 2024, our accountant, a Dutch company that offers Microsoft 365 solutions for businesses, let us know that one of their vendors had been attacked by ransomware. This is a malicious software that gains access to your application, steals its data and demands a ransom to recover it. Companies keep their data safe by means of secured backups that are physically located elsewhere, which is a great way to avoid their backups also being stolen.

To find out what the potential impact could be for us, we dug a bit deeper into the hack. And read once more the accountant’s email. One paragraph caught our attention:

Our accountant says they don’t know what data was stored on the network share. They also mention they would tell people if they found any personal information.

We wondered how they would ever get this clear. They hired external specialists for more research, which seems smart. But the first message from the affected company about the attack made us realise they shouldn’t have their hopes up. They said the ransomware encrypted “all backups and many of their large servers”.

The first and second updates on the hack made things even more clear. They said that backups were inaccessible or even overwritten. The experts they hired told them that these backups would “not be recoverable”.

Lastly the fourth update seems to indicate that there is a high probability that our accountant’s file share is subject to the hack:

Impact

On Proteon

Based on the information that is currently available, it is impossible for us to determine the impact on our organisation. Our security officer requested more information from our accountant to know if they are one of the twenty-five financial companies that are subject to this hack and to better understand if there was any information about our company, employees or customers stored there.

On the affected company – Brand damage

This hack potentially is impactful for the affected company. Although in their communication they mention that only ‘around 25 servers of the hundreds they manage’ were affected, the negative publicity it created reflects badly on the company. 

On the affected company’s customers – Data unavailability and data loss

The company’s articles show that customers couldn’t access their data for days. It’s possible the data is lost.

Prevention

Any company is a potential target

Let’s be clear: if the hackers got into the company’s systems via not yet discovered exploits, the company won’t be blamed for that. Forensic research will have to figure out when the hackers first hacked in and if the company could have caught them earlier. Any company is a potential target for hackers, and things will go wrong eventually.

Zero trust

So, how should we protect ourselves from these things? Well, it’s best not to trust anyone.

Assess and Spread risks

Follow the best practices:

1. read the terms of service and the service level agreements of all your suppliers;
2. write down the claims they make,
3. assess these and;
4. verify these

We know this is a bit of a hassle, but here’s an alternative: ask yourself some risk-based questions. For instance, what would happen if a certain online service wasn’t available? And what if you lost the info stored in that service? This will help you figure out how much you can trust a vendor and what extra precautions you might need.

If we look back at the case above, where a supplier was offering network shares to customers to store their files and documents, these customers could have opted for data replication to another vendor, e.g. by letting that other vendor create backups of the network share’s data.

Proteon to the rescue

We’re all about asking the right questions. We’ll help you do a risk analysis to make sure you only get the components you really need to be resilient. And if you want to go the extra mile, we’re happy to look over and test your vendor’s ToS and SLAs to make sure you get what you paid for.

Just a heads-up: the information and story above are based on what we’ve seen on our account and what the affected company has said on their own website. We haven’t spoken to the affected company directly.