Ransomware at a Common Service Centre
You are a trainee at a Common Service Centre in a block headquarters. The centre has one desktop running Windows 10, a single shared login, and one pen drive used by all four operators. The desktop holds a spreadsheet of 240 applicants for a welfare scheme, scanned caste certificates, and Aadhaar enrolment files. At 4:30 p.m., a pop-up appears: 'Your documents are encrypted. Pay ₹2,000 in gift cards within 2 hours to restore them.' Many files on the desktop now end in .lock, and a file named README.txt has appeared. The pen drive is still plugged in. The block office closes at 5:00 p.m., and the applicant list must be submitted today. The supervisor is away, the internet is very slow, and there is no IT support at the centre. A second computer at the block office is available but is not connected to the centre's printer.
1. List the first four actions you would take at the desktop, in order, and explain the reason for each.
Read the worked answer
- Stop using the desktop and unplug the pen drive, but do not delete files. Reason: ransomware may still be running, and the pen drive may be the infection route or the only clean copy; unplugging limits further spread, but deleting destroys evidence. 2) Do not open README.txt or any .lock file. Reason: the note is the attacker's instruction and may contain links or code. 3) Photograph the screen and note the time, then disconnect the desktop from the network if it is connected. Reason: this preserves evidence and may stop encryption from reaching shared folders. 4) Call the supervisor and the block IT or office contact, and label the pen drive 'do not use'. Reason: someone with authority must decide on reporting and recovery. Keep the desktop off until advice arrives.
2. A co-worker says, 'Just pay the ₹2,000; it is cheaper than losing the data.' Evaluate this advice using the facts in the case.
Read the worked answer
The advice is risky and probably wrong. Paying does not guarantee a key; the attacker may take the money and disappear, and payment encourages more attacks. The centre also has no secure way to buy gift cards, and spending public funds on an anonymous demand creates an audit problem. The amount ₹2,000 is not the real cost: the 240 applicants' data and the centre's reputation are at stake. The safer path is to preserve the machine, report the incident through the block office and the cybercrime portal, and restore the applicant list from a known clean source if one exists. Payment should be considered only on the instruction of senior authorities and never by the trainee alone.
3. How would you submit the applicant list today while protecting the affected files and the 240 applicants' personal data? Recommend a practical sequence.
Read the worked answer
First, do not reconnect the infected desktop or the pen drive to the block computer. Use the block office computer to rebuild the list from the source documents if a clean copy exists; otherwise, ask the block office to accept a handwritten or scanned list with a note explaining the incident. Second, submit only the minimum personal data needed today; avoid sending Aadhaar numbers or caste certificates by ordinary email or WhatsApp. Third, record which files are affected and inform the supervisor and the data owner in writing. Fourth, after the incident, change the shared login password, scan the pen drive on a clean machine, and arrange separate user accounts and offline backups. The priority is to meet today's deadline without spreading the infection or exposing applicants' data.