Ransomware at the Premium Counter

1. Isolate the network immediately: unplug the broadband router and disable Wi-Fi, and disconnect the affected PCs from the LAN. Ransomware can spread to mapped drives and other PCs, so containment comes before investigation.
2. Do not pay the ransom and do not delete READ_ME.txt or the encrypted files. Payment does not guarantee recovery and may fund crime; the note and encrypted files are evidence.
3. Preserve evidence: photograph each screen, note the time, the file extensions and the ransom message, and record which machines are affected. This supports insurance, police and forensic processes.
4. Notify the branch's IT/security team and senior management, and contact the insurer's incident-response or cyber-insurance helpline. Internal escalation should not wait until the cause is known.
5. Stop using infected machines for customer transactions. Use a clean standalone device or manual receipting with dual control, and tell the waiting customer politely that the system is unavailable rather than processing a payment on a compromised PC. Only after containment should staff attempt restoration from a verified clean backup.

The usable candidate is the staff member's personal cloud copy of premium_register.xlsx from 10 days ago, but it is only a candidate. Before restoring, copy it to a clean, isolated machine, scan it with updated antivirus, confirm the file type and modification date, check that macros are not embedded, and compare a few known entries with manual records. The 10-day gap means recent premium and commission entries will still need to be reconstructed from receipts and bank records.

The Z: drive copy is encrypted and therefore cannot be treated as a backup at all. It is also a mapped network drive on the same network, so it was reachable by the ransomware and was encrypted along with the PCs. In 3-2-1 terms, a backup should have at least three copies, on two different media, with one copy offsite or offline. A mapped drive is neither isolated nor offline. The cloud copy is offsite but is a personal account and may be incomplete, so it should be treated as one recovery source, not a complete backup strategy.

.xlsm is a macro-enabled Excel workbook. It can contain VBA macros that run code when the file is opened or when a button or event is triggered. That makes it a delivery route for malware and a means of altering or exfiltrating data, unlike an ordinary .xlsx file that cannot store VBA macros.

After the incident, staff should disable macros by default, open files from external sources only in Protected View, and use the Trust Center to block macros from the internet. The branch should keep the commission sheet in .xlsx if no macros are genuinely needed, restrict who can edit it, and store it on a controlled shared drive with version history. Before opening any .xlsm file received by email or found on a USB drive, staff should verify the sender and the file's actual type; a mismatch between the extension and the file signature is a red flag. Macros should be enabled only for signed, approved files, and never on a machine that has just been restored from backup until it has been scanned.