Ransomware at a 25-person accountancy firm
A 25-person accountancy firm in Valletta runs a Windows file server holding client records, payroll files and tax returns. On a Monday morning staff find that many files have been renamed with a .locked extension and a ransom note demands payment in cryptocurrency within 72 hours. The firm's only backup is a nightly full backup written to a USB hard drive that stays permanently connected to the file server. The most recent backup completed at 23:00 on Sunday, about 26 hours before discovery. Several staff report receiving an email on Friday with an attached 'invoice' that asked them to enable macros. One employee opened it. The firm's managing partner wants to pay the ransom quickly to avoid disruption and has asked whether the firm must tell anyone.
1. Set out the immediate response in a sensible order, explaining why each step comes where it does.
Read the worked answer
1. Isolate, do not power off. Disconnect the file server and the affected workstation from the network, and disable Wi-Fi on laptops. Pulling the plug can destroy volatile evidence and may interrupt encryption mid-file, but more importantly the encryption may still be running. Isolating stops spread to other shares and to the backup drive.
2. Disconnect the USB backup drive immediately. It is the firm's recovery asset and it is currently attached to an infected machine. Every minute it stays connected risks it being encrypted too.
3. Preserve evidence before cleanup. Take photographs of the ransom note, record filenames and extensions, and note the time of discovery. Do not delete the malicious email; export it with headers. This supports any later police report and helps identify the entry point.
4. Determine scope. Which shares, which machines, which accounts? Check the file server logs and the mail gateway for other recipients of the same message. Identify whether the employee's credentials were used elsewhere.
5. Restore from the Sunday 23:00 backup to clean hardware or a clean virtual machine, after verifying the backup is not itself encrypted. Accept that up to 26 hours of work may be lost or must be reconstructed from paper, email and client copies.
6. Only then reconnect and reset credentials. Force password changes, especially for the affected user and any administrator accounts, and check for persistence such as scheduled tasks or new local accounts.
Order matters because containment must precede investigation, and investigation must precede cleanup. Restoring before disconnecting the backup risks destroying the only clean copy.
2. Evaluate the firm's backup strategy and propose an improved one. Use specific numbers where possible.
Read the worked answer
Current strategy is a single point of failure. One full backup per night to one permanently connected USB drive has three defects:
- It is online. Ransomware running on the server can see and encrypt the backup drive. Many strains deliberately target mounted drives and network shares.
- There is no version history. If the Sunday backup were corrupted or the encryption began before 23:00, there is no earlier copy to fall back to. The firm cannot go back to Friday.
- There is no off-site copy. Fire, theft or physical damage to the server room destroys both the live data and the backup.
Recommended: 3-2-1 with offline and versioned copies.
- 3 copies: production data, a local backup, and an off-site copy.
- 2 different media: for example a local NAS and encrypted cloud object storage, or rotated removable drives.
- 1 off-site: cloud or a drive taken home by a partner each night.
Practical detail. Keep at least 30 daily restore points and 12 monthly ones, so a 26-hour gap becomes a 24-hour gap at worst with 29 earlier fallbacks. Disconnect or unmount removable drives after backup. Use backup software that writes immutable or append-only versions, so a compromised server account cannot delete history. Test a restore quarterly - an untested backup is a hypothesis, not a backup. Encrypt backups at rest because they contain client tax data.
Trade-off: cost and administrative effort rise. For 25 staff the storage volume is modest, so the main cost is discipline, not hardware.
3. The managing partner asks: should we pay the ransom, and do we have to report this? Advise, with reasoning.
Read the worked answer
On paying: advise against it, on practical and ethical grounds.
- No guarantee. Payment may not produce a working key, and some groups re-extort the same victim.
- It funds crime. Payment sustains the ecosystem that will attack other Maltese firms.
- It marks the firm as a payer. Future targeting is more likely.
- It may not restore everything. Decryption is often slow and partial, and the firm still has to rebuild.
- Sanctions risk. Paying an entity under sanctions can create legal exposure, so even considering payment needs legal advice.
The firm has a viable alternative: restore from the Sunday 23:00 backup and reconstruct up to 26 hours of work. That is painful but bounded. Paying is unbounded.
On reporting: the firm should treat this as both a criminal and a data protection matter. Client tax and payroll records are personal data. A confidentiality breach should be assessed without undue delay, and where it is likely to result in a risk to individuals it must be notified to the supervisory authority - in Malta, the Information and Data Protection Commissioner - generally within 72 hours of becoming aware. The firm should also report the criminal offence to the Malta Police Cyber Crime Unit and consider notifying its insurer. The managing partner should not decide this alone; the firm's data protection officer or legal adviser should be involved. Documenting decisions and timings is essential, because regulators assess how the firm responded, not only what happened.