Ransomware at Burhan Traders
Burhan Traders is a Sialkot sports-goods exporter that runs a PHP-based B2B order site on a shared hosting plan costing PKR 9,000 a month. The site holds 41,000 customer and prospect records, including tax numbers and shipping addresses, plus six years of order history. The company has one IT officer who also handles printer support, and backups are taken "when someone remembers" - the last verified restore was 19 months ago. On a Monday morning the order database is found encrypted, with a ransom note demanding USD 4,000 in cryptocurrency; the attackers entered through a credential phished from the sales manager three weeks earlier. The last three days of orders exist only in sales staff email inboxes. A cloud migration quote is PKR 4.2 million a year; refreshing the on-premise server with proper backup, monitoring and a managed firewall comes to PKR 9 million in capital plus PKR 1.8 million a year. The company's largest buyer in Germany has begun sending a security questionnaire.
1. Sequence the first 72 hours. Justify the ordering and say whether the ransom should be paid.
Read the worked answer
Ordering matters more than speed - doing these out of order destroys evidence or re-infects the environment.
- Contain (hours 0–4). Take the site offline. Revoke the sales manager's credentials and every shared password; enable MFA everywhere; isolate the affected host. Do not wipe anything yet.
- Preserve (hours 4–12). Image the server and export web, authentication and mail logs before any rebuild. You cannot establish whether the 41,000 records were copied without logs, and that question decides every notification and contractual obligation downstream.
- Assess recoverability (hours 12–36). Check whether the backup media were also reachable from the compromised host - in this setup they probably were. Locate the last clean restore point. The three days of orders in staff inboxes are recoverable by hand and should be reconciled before the order system returns, or those customers get double-shipped or dropped.
- Notify (hours 24–72). Report to the FIA's cybercrime wing; answer the German buyer honestly; check the acquirer/PSP contract if card data was ever in scope; check insurance.
- Restore and rebuild only after the initial access route - the phished credential - is closed, or you will be re-encrypted.
Do not pay. There is no guarantee of a working key, payment funds further attacks, and the payment itself may create sanctions and reporting complications. The recovery path is the backup plus manual reconciliation; USD 4,000 is trivial next to the cost of normalising ransom payment.
2. Cloud at PKR 4.2M/year or on-premise refresh at PKR 9M capex plus PKR 1.8M/year? Frame the decision properly rather than comparing headline numbers.
Read the worked answer
Five-year totals: cloud ≈ PKR 21M. On-premise ≈ 9M + (1.8M × 5) = PKR 18M, plus the cost of the IT officer's time on maintenance - which is the actual failure point in this case, not the hardware.
The numbers are close enough that cost is not the deciding variable. The right question is: which option is survivable with one IT officer who splits his time with printer support? The incident that just occurred was not a hardware failure; it was an operational failure - no verified restores, no MFA, no monitoring. On-premise refresh reproduces that same operating model with newer boxes.
Recommendation: managed cloud for the order site and customer database, against a written SLA, because patching, backup verification and monitoring become someone else's contracted obligation with a named remedy. Keep a small on-premise file server for design files and shipping documents.
But test the cloud quote against these before signing:
- RTO and RPO in the contract, not in the sales deck - how fast can you be restored, and how much data can you lose?
- Data residency, given the German buyer's questionnaire will ask exactly this.
- Egress and exit costs, and whether you can export your own database in an open format.
- Whether the quote includes backup verification and DR testing, or only storage.
If the SLA is vague, the cloud quote buys the same risk at a higher price.
3. What are Burhan Traders' notification and legal exposures? Distinguish what is certain from what must be verified.
Read the worked answer
Certain - act on these now:
- Tax and audit retention. Six years of order history is also accounting evidence. Loss of records is a tax/audit problem regardless of the attack. Reconstruct from invoices, bank statements and courier records and document the reconstruction method.
- Contract. The German buyer's questionnaire is the leading indicator; a supply contract almost certainly carries security and confidentiality terms. Read it before replying, because the reply is a representation the company must stand behind.
- Criminal complaint. The conduct described - unauthorised access, interference with data, and extortion - falls within the Prevention of Electronic Crimes Act 2016, and reporting goes to the FIA's cybercrime wing. Reporting also creates the record the company needs if insurers or buyers ask what was done.
- Card data. If card details were ever stored on this host, the acquirer/PSP contract imposes its own notification duty and the merchant may face forensic-investigation costs.
Must be verified, not assumed:
- Pakistan has repeatedly circulated a comprehensive personal data protection bill but, on the last published status I can confirm, it had not been enacted. Do not assert a statutory 72-hour breach-notification duty to the board without confirming current law.
- Sector rules: State Bank cybersecurity requirements bind regulated entities, not a general exporter - confirm this does not apply.
Present the board with one page separating "obligations we have" from "obligations we may have".