Sefwi Rural Bank: ransomware with no clean backup
Sefwi Rural Bank has nine branches, 240 staff and total assets of GH₵180 million. Its core banking application is hosted by a vendor in Accra, but everything else sits on a single head-office server: scanned KYC documents, loan files, payroll, board papers and the email archive. On a Monday morning staff cannot open any of these files; each folder contains a ransom note demanding USD 20,000 in bitcoin. The backup is a network-attached storage device in the same server room, joined to the same domain. The only offline copy is a monthly tape kept in a strongroom three metres from the server; the most recent tape is nine weeks old because the rotation roster lapsed in January. Branch transactions for the last three days exist only on manual paper schedules. There is no incident response plan, no cyber insurance, and the IT Manager's first instinct is to pay.
1. Set out your decisions and their sequence for the first 72 hours, stating who should decide what.
Read the worked answer
Hours 0-4: contain, do not clean. Disconnect affected hosts from the network and disable compromised accounts, but do not wipe or reimage anything yet: the ransom note, logs and file timestamps are the only evidence of how entry occurred, and there may be an obligation to report. Confirm the core banking service is genuinely unaffected by checking with the hosting vendor's logs rather than assuming. Activate a small crisis team: Managing Director (chair), IT Manager, head of operations, company secretary or legal adviser, and a nominated communications lead. The board chair is informed the same day.
Hours 4-24: establish facts before messaging. Engage an external incident response firm and notify the Police Cybercrime Unit. Determine scope: which systems, whether data left the network (extortion without encryption is common), and whether administrator credentials are compromised. Grant the authority to spend up to a pre-agreed ceiling without further approval, or the response will stall.
Decisions and decision rights. The board, not the IT Manager, decides whether to pay any ransom, and records the reasoning. The Managing Director decides on branch operations and customer communication. Legal decides on regulatory notification. Technical containment sits with the IT Manager and the external firm jointly.
Hours 24-72: restore operations and report. Rebuild from the nine-week-old tape in an isolated environment, then re-enter the three days of paper transactions with dual control and an audit trail. Notify the Bank of Ghana promptly under its cyber and information security requirements - assume a 24-hour expectation for a material incident and confirm the exact wording with counsel. Notify the Data Protection Commission if personal data was compromised. Customers should hear a factual statement that services are affected and what to do, before rumour fills the gap.
2. Should the bank pay the ransom? Advise the board, addressing the counter-arguments.
Read the worked answer
Recommendation: do not pay, and record the decision as a board minute with reasons. The advice must be genuinely balanced, because there is real operational pressure.
The case for paying. Recovery from a nine-week-old tape means losing up to nine weeks of scanned documents and re-keying work; the bank may face customer complaints and supervisory criticism. A USD 20,000 payment is small against the cost of a slow rebuild, and the board will be asked why it did not simply resolve the problem.
Why that reasoning is nonetheless weak.
- There is no guarantee of decryption; decryption tools from criminal groups routinely fail on some file types.
- Payment funds and incentivises further attacks, and the bank becomes a known payer.
- The payment route may itself breach sanctions or anti-money-laundering rules, and the bank's own AML controls would have to be suspended to make it - an uncomfortable position for a regulated institution.
- The data may already have been copied, creating a second extortion lever that payment does not remove.
- Restoration is achievable without payment: the tape plus three days of paper records, with a documented reconciliation.
If the board overrides this advice, insist on: a written risk assessment, engagement of a specialist negotiator rather than direct contact, sanctions screening of the receiving wallet, no payment from customer funds without supervisory awareness, and full documentation for the auditor and regulator. The worst outcome is a payment made quietly and badly.
What must not happen. The bank should not delay regulatory notification while it negotiates. Notification and negotiation are independent decisions.
3. Recommend a prioritised recovery and control programme for the next twelve months, with a rationale a board will accept.
Read the worked answer
Frame it as risk reduction per cedi, not as an IT shopping list.
0-3 months (do first, cost mostly effort).
- Backup rebuild on the 3-2-1 principle: three copies, two media, one offline and immutable. Physically separate the backup from the domain so that a single set of credentials cannot destroy both. Test a full restore quarterly and record the time taken; an untested backup is a hope, not a control.
- Written incident response plan with named roles, a contact tree, a 24-hour decision protocol and one tabletop exercise.
- Restore the tape rotation roster with a named deputy, and a monthly management sign-off that the offline copy exists.
- Multi-factor authentication on remote access and on all administrative accounts; remove standing administrator rights from day-to-day accounts.
3-6 months. Patch management with a tracked schedule; endpoint protection with central monitoring; network segmentation between the file server and the core banking network path; email filtering and staff phishing awareness; a privileged access review each quarter.
6-12 months. Board-level cyber reporting using a small set of measures (restore test result, patch compliance, phishing test failure rate, open audit findings). Third-party assurance over the hosting vendor, including their incident notification obligations. Cyber insurance, but only after the controls above, or the premium buys little. Consider a formal certification path such as ISO 27001 only if customers or the regulator demand it.
Justification for the board. The bank's exposure is not the USD 20,000 demand; it is the nine weeks of records that could have been lost and the customer trust that would have gone with them. The first three months cost mainly discipline.