Pay, Rebuild, or Both After a Destructive Ransomware Attack
Calder Industrial has six plants and a converged IT/OT network. A ransomware affiliate gains domain administrator access, encrypts 2,300 virtual machines, and wipes the virtualization management plane. It exfiltrates 80 GB, including employee HR records and engineering drawings. The demand is $4.5 million in cryptocurrency within 72 hours; an incident response firm says a negotiated payment might be $1.2 million. About 70 percent of backups are immutable; the remaining 30 percent are SAN snapshots that the attacker deleted. Restoring the immutable set takes an estimated nine days to reach 60 percent production and three weeks for full output. Safety instrumented systems are unaffected, but the manufacturing execution system is down, and four customer contracts impose $250,000 per day in penalties after day five. Cyber insurance has a $10 million limit with a $2 million sublimit for extortion payments and requires panel counsel and forensics. The board asks whether to pay.
1. Advise the board on whether to pay. Lay out the decision criteria and a recommended conditional path.
Read the worked answer
Do not answer yes or no from the demand letter. Separate the two problems: decryption and data theft. Payment may produce a decryptor, but it does not reliably prevent publication, and it does not restore deleted snapshots or the management plane. The board should decide on evidence.
Criteria: whether a decryptor works on a sample without further harm; whether the attackers have demonstrated they hold the data and can publish it; sanctions and legal exposure, including OFAC screening and counsel advice; insurer approval and sublimits; law enforcement guidance; the cost and time of rebuilding versus the payment; and the effect on customers, employees, and future extortion. Also consider that paying may fund criminal operations and increase targeting.
A defensible conditional path is to authorize the negotiator to engage and test a decryptor, but not to authorize payment until counsel, sanctions screening, insurer approval, and law enforcement consultation are complete. Compare the $1.2 million payment with the penalty exposure: at $250,000 per day after day five, the nine-day partial restore implies roughly $1 million in penalties before full output, before considering lost margin. That does not by itself justify payment, especially when 70 percent of backups are intact. My recommendation would be to prioritize recovery and validation, prepare for notification, and keep payment as a board-level option only if a tested decryptor materially changes the recovery timeline and all legal conditions are met. Document the decision and dissent.
2. Sequence recovery across IT and OT. What must happen before any plant reconnects?
Read the worked answer
Start with safety and containment, not with the ERP. Confirm safety instrumented systems remain isolated and independently operable. Contain the IT network, remove attacker persistence from identity and virtualization management, and rebuild administrative infrastructure from trusted media. Treat the 70 percent immutable backup set as the primary source, but restore it to a clean environment with new credentials and no route to OT until validation is complete.
Recover in dependency order: identity and DNS, core network, backup and monitoring, ERP and manufacturing execution system, then plant by plant. For each plant, verify that the MES data reconciles with production records, that engineering drawings are untampered, and that no unauthorized remote-access path exists. Segment IT from OT and enforce allow-listed industrial protocols. Bring up the highest-margin or most customer-critical line first, not every line at once.
Before reconnecting any plant, require a signed checklist: containment confirmed, clean credentials deployed, endpoint detection active, backup restored and validated, OT segmentation tested, and plant management trained on degraded operations. The 30 percent of systems without immutable backups may need rebuild rather than restore. Communicate realistic dates; a premature reconnect risks a second encryption event.
3. What legal, regulatory, and communication actions should run in parallel with recovery?
Read the worked answer
Run a parallel workstream led by counsel. Preserve evidence and establish legal hold and privilege where applicable. Determine notification obligations for the 80 GB of HR data and engineering drawings: state breach laws, GDPR timelines for EU employees, customer contractual notices, and sector regulators. Do not wait for full forensic attribution to start the assessment, but do not send speculative notices.
Engage the insurer early, confirm panel counsel and forensic scope, and get approval for any extortion-related spend. Notify law enforcement and follow their guidance on payment and indicators. Prepare employee, customer, and supplier communications with one spokesperson and a cadence. Avoid statements that the data is safe or that recovery is complete before validation. Engineering drawings may be customer-confidential, so notify affected customers under contract and assess intellectual property exposure.
Track every notification decision, recipient, and timestamp. The board should receive a single log of legal obligations and communications, separate from the technical recovery report. This prevents recovery progress from being confused with legal closure.