Ransomware at a Tier-1 Automotive Supplier

The first 24 hours should establish command, not force a payment decision. Activate the crisis team and separate incident command, legal, communications, operations, finance, and insurer liaison. Contain spread, preserve evidence, and engage insurer-approved forensics and counsel immediately because the policy requires pre-approval. Verify what actually restores: ERP at 72 hours is plausible, but the untested MES estimate of 10 days is the dominant business risk. Start manual workarounds and assess safety, quality, and customer commitments. Notify OEM customers according to contract and safety obligations. The CEO's public statement is a communications position, not an operational constraint. The board can authorize negotiation through a specialist without authorizing payment, subject to sanctions screening, legal review, insurer approval, and proof that a decryptor works. Communications should avoid contradicting the CEO while preserving flexibility, for example by saying the company will follow legal and safety obligations. Log every decision and assumption because the board will need a defensible record.

The ransom is $2.1 million, but payment does not guarantee recovery: decryption may fail, the decryptor may be slow, malware may persist, and the attackers may still leak data. Ten days of downtime at $450,000 per day is $4.5 million before OEM penalties and reputational harm, so a payment that reliably restored operations in three days would have a large expected-value advantage. But the probability of reliable restoration must be tested, not assumed. A decision matrix should compare: payment plus partial recovery, rebuild without payment, and hybrid recovery using backups plus manual workarounds. Dominant factors are recovery time, confidence in backups, safety and customer penalties, legal and sanctions exposure, insurer approval, and data-leak consequences. The board should authorize negotiation only under conditions: verified decryptor on a sample, sanctions clearance, insurer consent, and a cap. It should not treat the CEO statement as a reason to reject analysis. If payment is rejected, the board must explicitly accept the 10-day MES outage and its penalties as residual risk.

Days 1-30: complete forensic containment, validate all backups, test an MES restore in an isolated environment, and document actual recovery time. Establish an incident response retainer and a decision framework for ransom, legal, insurer, and communications. Days 31-60: segment OT from IT, enforce privileged-access management and MFA for backup and ERP administration, deploy immutable or offline backups for MES, and rehearse manual production fallback with the plant team. Days 61-90: run a ransomware tabletop with OEM communication, review cyber insurance limits and sublimits, and add supplier and customer notification procedures. The residual risk should be stated explicitly: until MES restore is proven, a repeat event could still exceed the 48-hour customer penalty threshold. The board should accept that residual risk with a named owner, an expiry date, and triggers for escalation. Track recovery time objective tests, backup restore success, percentage of OT segmented, and time to activate manual fallback as key indicators.