Ransomware at a Community Advice Charity
A community advice charity has 45 paid staff and 12 volunteers. It holds case notes, scanned identity documents and benefit records for 8,000 clients on a cloud file-sharing service and a local Windows file server. All staff use one shared 'admin' account for the file server because the office manager says individual accounts slow down hot-desking. Backups run each night from the file server to a USB hard drive kept in the same office. On Monday, staff find files renamed with .locked and a ransom note demanding 3 BTC. The cloud files are intact, but many were overwritten by a synchronised local folder. The charity has a cyber-insurance policy that requires 'reasonable security controls'. The trustee board wants to pay the ransom quickly, restore from the USB drive, and continue using the shared admin account to avoid disruption to a drop-in session on Wednesday.
1. Advise the board on the immediate priorities for the first 24 hours. Justify the order of actions and explain why paying the ransom should not be the first choice.
Read the worked answer
First contain the incident. Disconnect affected machines from the network, disable the shared admin account and remote access, and stop the cloud sync so that clean cloud versions are not overwritten further. Preserve the ransom note, logs and affected disks where possible; do not wipe evidence. Contact the cyber insurer and any agreed incident-response provider early, because policy conditions may require notification and approved specialists.
Second assess scope and legal duties. Identify how the attacker entered, which accounts and data were accessed, and whether the USB backup is clean. Because the charity holds personal data for 8,000 clients, it must assess whether the incident is a reportable personal data breach. If UK GDPR applies, notification may be required within 72 hours of becoming aware, and affected clients may need informing if there is a high risk. The board should take legal advice before making any ransom payment.
Third recover in a controlled order. Rebuild affected systems from known-good backups, reset credentials, enable MFA, and restore cloud files from version history after checking them. For Wednesday, use clean loan devices, cloud access with individual accounts, or paper forms rather than restoring the compromised shared login.
Paying the ransom should not be the first choice. There is no guarantee of decryption, payment may fund crime, may breach sanctions or insurer conditions, and does not remove the vulnerability. Restoration and containment address the cause; payment only buys an uncertain shortcut.
2. Evaluate the backup arrangement and propose a more resilient 3-2-1 backup design for 8 TB of data, with specific controls to protect data integrity.
Read the worked answer
The current arrangement is weak. It keeps one backup copy on a USB drive in the same office, so fire, theft or ransomware can destroy both primary and backup. The drive may be permanently connected, allowing malware to encrypt it. There is no stated retention, versioning or restore test, and the cloud sync copied encrypted files over good copies. It does not meet a reasonable 3-2-1 standard.
A better design is three copies of the data, on two different media, with one copy offsite or immutable. For example: the primary file server; a local NAS with snapshots on a separate network segment; and an encrypted cloud backup or a rotated offline hard drive taken offsite. The cloud copy should use versioning and object lock or immutable retention so an attacker cannot delete or overwrite history. Keep at least 30 daily and 12 monthly versions for 8 TB of data, so plan for more than 8 TB of backup capacity because of versions and overhead.
The backup system needs separate credentials from the shared admin account, MFA for backup administrators, and write-only or append-only permissions for the backup agent. Monitor backup failures. Test a restore at least quarterly, and record the recovery point objective and recovery time objective: for this charity, a 24-hour RPO and a two-day RTO may be realistic. The USB drive should not be the only recovery route.
3. The office manager argues that individual accounts are unnecessary because staff are trustworthy and the shared login is simpler. Assess this argument using least privilege, accountability and data protection principles.
Read the worked answer
Trust is not a security control. The shared admin account gives every member of staff, and anyone who learns the password, access to all client records and file-server settings. That breaches least privilege: a volunteer checking opening times does not need benefit records or the ability to delete files. It also destroys accountability, because logs show only 'admin' rather than the person who viewed or changed a record. If a record is leaked or altered, the charity cannot investigate who did it.
The shared account makes joining and leaving staff harder to manage. A password must be changed for everyone when one person leaves, and MFA cannot be tied to an individual. It also weakens data protection: personal data should be accessible only to those who need it, and confidentiality and integrity should be maintained. The trust argument ignores accidental misuse, phishing and insider risk.
Hot-desking can still be fast with individual accounts: use single sign-on, roaming profiles or cloud desktops, role-based groups, password managers and quick session switching. Keep a separate break-glass administrator account, not a shared day-to-day login. The correct response is to make individual accounts convenient, not to remove them.