Business smarts
HELD TO
RANSOM In this first-hand account of surviving a ransomware attack, Martin de Gouw of Clyne & Bennie Plumbing recalls the disruption it caused, and warns other businesses not to be complacent. AUTHOR: MATTHEW LOWE
M
artin de Gouw says he scoffed at the idea of taking out cyber insurance for his plumbing company when the suggestion was first pitched to him a number of years ago. But the Managing Director of Christchurch-based Clyne & Bennie was grateful he eventually plumped for a policy when a year later the business fell victim to a ransomware attack. The incident happened about six years ago and saw a number of the company’s files locked up and the hackers demanding 325 bitcoin, which Martin says was “probably equivalent to about $300,000”, to restore the data. Clyne & Bennie was able to recover the affected files from a back-up and did not pay out any ransom. However, it led to a number of IT changes to minimise the risk of falling victim to any future attack.
Lessons learned “It highlighted to us that your IT systems need to be reviewed independently by external parties periodically to make sure they are working as well as they should,” explains Martin. “The cyberattack effectively locked up our document store but we managed to restore from our back-up. We were lucky
58
nzplumber
they didn’t get into our operational database and job management files. “The whole thing was very disruptive. We had to rebuild the server, which they corrupted, and then we had to bring all the data back. We also claimed on our first cyber security insurance policy that we had only taken out about a year before.” Martin adds the cyber insurance claim paid out about $15,000, which included paying for the time it took technicians to restore the corrupted files. Clyne & Bennie now has multiple back-ups of its files, he says. These include a live replication of its system to another server, cloud back-up for the server and a hard disk back-up that is taken off site.
Risks are real Martin warns other businesses not to be complacent about the risk of a cyberattack and to take the matter seriously. “When we first got asked about taking out cyber insurance, I thought, ‘Really? We’re a little plumbing company.’ But what happened—and has also happened to others—shows that any system can be a target, so it pays to get the right protections and back-up in place.”
