Ransomware at Kesterly Insurance: 72 Hours and a Backup in the Same Room

Order of operations

1. Contain. Pull the server and affected endpoints off the network, disable compromised accounts, and stop the nightly backup job from overwriting anything still intact. Containing first prevents further encryption and preserves evidence; everything else is undermined if the attacker is still moving.
2. Call the cyber carrier and engage counsel today. The policy pays for panel forensic and negotiation firms, and the notification clock and coverage conditions (prompt notice, pre-approval of vendors) start now. Privilege through counsel protects the forensic findings.
3. Preserve and scope. Have the forensic firm image systems and determine what data was actually accessed or exfiltrated, whose records, and whether the threat actor is still present. Notification duties depend on this scoping, not on the ransom note.
4. Report to law enforcement (FBI IC3 or local field office) and coordinate with the carrier's breach coach on regulator notification.
5. Restore and rebuild from any surviving copy - cloud mailbox, agent laptops, paper files, the carriers' own portals - to get renewals processed, since the business itself is a source of recovery.

Who decides whether to pay - the owner, but only after input from counsel, the incident response firm, the insurer, and law enforcement. Required information: whether any clean backup exists, whether the decryptor is likely to work (it often fails or is slow), whether the wallet passes OFAC sanctions screening (paying a sanctioned actor is illegal), the total cost versus a rebuild, and the fact that paying does not extinguish notification duties or the risk of a second extortion.

Content of the client notice

• What happened, in plain terms: unauthorized access to systems, files encrypted, data may have been accessed.
• The specific data elements involved (name, address, SSN, driver's license number) - not a vague 'some information.'
• When it happened and when it was discovered.
• What the agency has done: containment, forensics, law enforcement report, restoration.
• What is offered: credit monitoring and identity-theft protection, a dedicated call center, enrollment instructions and deadlines.
• What clients should do: watch accounts, consider a fraud alert or credit freeze, and use the provided contact.
• Who is signing: the principal or a designated spokesperson, not an account manager.

What must not appear - speculation about the attacker's identity, assurances that data was not misused (unknown), any admission of legal liability, or technical jargon that obscures the point. Counsel reviews before release.

Regulatory filings - state breach-notification statutes typically require notice without unreasonable delay, and several impose fixed deadlines (30 or 45 days is common); the state insurance regulator and possibly the carriers whose data is held also require notice under contract. Counsel confirms each jurisdiction and deadline.

The 'everything is fine' script must stop. A false reassurance to policyholders creates its own consumer-protection and negligence exposure and destroys credibility when the truth arrives. Give agents a short approved script: acknowledge the incident, state that systems are being restored, and point clients to the official notice and call center. Everyone uses the same script, and questions are routed to one named contact.

Ranking

1. Immutable, offsite backup (roughly $15,000–$20,000 setup plus storage). The single failure that turned a bad day into a crisis was a backup sitting on the same network, deletable by the attacker. A 3-2-1 design - three copies, two media, one offline or immutable with versioning and tested restores - removes the attacker's leverage. Test a restore quarterly and record the result.
2. MFA on email, remote access, and the management console of the backup (roughly $5,000–$10,000). The entry vector was a malicious attachment followed by credential use. MFA does not stop a user from clicking, but it blocks the account takeover and lateral movement that follow.
3. Endpoint detection and response with 24/7 monitoring (roughly $15,000–$20,000 a year for 45 endpoints). Encryption took under two hours; only continuous monitoring has a chance of catching that behavior before the file server is gone.
4. Phishing simulation and training plus a reporting button (roughly $3,000–$5,000). Cheapest and useful, but weakest alone: this employee was phished despite whatever training existed, and culture improves only when technical controls catch what people miss.

Defer a full SIEM build-out, an enterprise identity product, and new hardware refresh. Hold back $8,000–$10,000 as a contingency and for tabletop exercises and a written incident response plan that names decision-makers and contact numbers.

Justification logic - spend first on the controls that eliminate the catastrophic outcome (unrecoverable data), then on the controls that interrupt the observed kill chain, then on reducing the probability of the initial click.