Ransomware at a Month-End Branch
At 11:40 a.m. on a month-end Saturday, a district cooperative bank branch has 3,000 active accounts and a queue of customers. A clerk opens an email claiming to be an RBI inspection notice with a macro-enabled Excel attachment. Shortly afterwards, shared files on the branch server become encrypted and a ransom note appears. The branch uses a central CBS application hosted by a vendor, a local file server for scanned KYC documents, and one external hard disk kept in the manager's drawer for weekly backup. The last successful backup was six days ago. The manager wants to pay the ransom in cryptocurrency to restore service before 2 p.m. The vendor's helpline is busy. Staff can still see the CBS login screen on two terminals but cannot open local documents. The regional office asks for immediate containment, an honest assessment of recovery options, and a customer-communication plan.
1. List immediate containment steps for the first 30 minutes in priority order, and state what must not be done.
Read the worked answer
- Isolate the affected clerk's computer and the local file server from the network-unplug Ethernet, disable Wi-Fi, and block the account/device at the switch or firewall. Do not let staff keep opening shared files.
- Preserve evidence: photograph the ransom note and screen, keep the machine powered if policy says so, and do not delete files or run cleanup tools.
- Notify the branch incident lead, regional IT/security, and the vendor through a known-good phone number; escalate to CERT-In/cyber police as per bank policy.
- From a clean device, reset high-risk credentials, especially admin and email accounts, and block the sender/attachment.
- Confirm whether CBS is truly affected; keep two CBS terminals on a separate trusted path only if the vendor confirms it is safe.
- Start a written timeline and customer queue plan. Do not pay the ransom, do not reconnect the encrypted server to the network, do not restore backups over live data before malware scanning, and do not use the same infected admin credentials to 'fix' the problem.
2. Evaluate the ransom proposal and the six-day-old backup plan; recommend a recovery decision.
Read the worked answer
Paying is not a recovery plan: it may not produce a working decryptor, funds criminal activity, may breach bank/legal policy, and encourages repeat attacks. The six-day-old external disk may be clean if it was disconnected, but it is not sufficient by itself: it is old, stored in the manager's drawer without controls, and has not been restoration-tested. Recommend: do not pay; keep the encrypted server isolated and preserved; verify the external backup on a separate clean network, scan it, and restore to new/rebuilt hardware; use the vendor-hosted CBS as the source of truth for account transactions and reconcile the six-day gap from CBS logs, ATM/UPI records, and customer receipts. Rebuild local KYC scans from source documents where possible. If the backup is infected or incomplete, recover from an earlier off-site/immutable copy. Communicate realistic timelines, not a 2 p.m. promise.
3. Draft a short customer communication and identify two controls to prevent recurrence.
Read the worked answer
Draft: 'Dear customer, some branch document and local file services are temporarily unavailable due to a cyber incident. Your deposits and CBS-linked account records remain protected; we are working with our vendor and security experts to restore services. We will never ask for your PIN, OTP or password by phone or email. Please use official branch/helpdesk channels for updates. We regret the inconvenience.' Adjust the 'deposits remain protected' claim only after verifying CBS integrity; if not verified, say 'we are verifying CBS records and will update you.' Two controls: (1) disable macros and block risky attachments at the email gateway, with staff phishing drills; (2) maintain offline/immutable backups tested for restoration, plus least-privilege admin accounts and network segregation of the local file server from CBS terminals. Also require vendor remote-access logging and an incident-response contact list.