The aftermath of a ransomware attack last month demonstrates just how bad an attack can get when the cybercriminals don’t get what they want.
Imagine you get hit with ransomware, you refuse to pay the ransom, you have no cyber insurance, and the attackers release millions of records of customer data. It’s a nightmare scenario for any organization – and exactly what happened to Medibank last month.
Upon being made aware of the encrypted data and systems, Medibank’s investigations found that hackers had significant access to their data, including:
- All personal data and health claims data from subsidiary AHM Health Insurance
- All international student customers’ personal data and health claims data
- All Medibank customers’ personal data and health claims data
24 hours after a ransom warning was made that threatened the leaking of the exfiltrated data, portions of Medibank’s stolen data was published, pushing them into the spotlight. Hackers have warned that the data published thus far is only a part of the total data set they have, potentially leaving the door open to future extortion.
I do want to say that this is not a tale designed to warn you that organizations should pay the ransom. Ideally no one should because that only encourages the bad actors. Instead, the takeaway from this article the fact that organizations need to make every effort to keep an attack like this from ever happening – something that includes a layered security strategy based on known attack methods, the greatest of which includes phishing attacks. Email security, DNS scanning, and Security Awareness Training to properly fend off email-based attacks (which is the primary attack vector in ransomware attacks.)
