The FBI reports that in the first quarter of 2016 the costs associated with ransomware attacks in the US were more than eight times the costs in all of 2015 ($209-million in the first quarter of 2016 versus $24-million for 2015). Canadians should also be concerned. Canada is fourth on the list of countries most commonly hit by ransomware and social media scams, reports Symantec. In 2015, Canadians were reportedly affected by over 1,600 ransomware attacks each day. Just a few weeks ago, the University of Calgary paid $20,000 to cyber-attackers to restore its systems.
The fact that the University was largely unprepared for this type of attack is not uncommon among large organizations. The University paid up because it could not afford to lose critical data, a situation that many other organizations have encountered lately. Some companies are even stockpiling bitcoins, the currency used to pay the ransom, in the event they are targeted and need to pay up. This is not the type of ‘planning’ that we are advocating.
With appropriate systems in place, the University may have been able to recover its data without having to pay a dime. Some of these systems include up-to-date software, anti-virus tools, protected backup, employee training and, lastly, cyber-insurance to help cover losses related to ransom and cleanup. Cloud storage can offer some measure of protection because data is not stored locally, but even cloud-based applications need to be scanned for malware.
Perhaps the most vexing thing about the lack of preparedness on the part of the University of Calgary is that it offers an online course in cybercrime prevention that teaches how to “maintain your organization’s information security and online safety”. We hate to say it, but… lesson learned.