Ever wondered why security compromises are announced in cryptic yet seemingly positive phrases, especially when it comes to government affairs? “We immediately alerted experts and authorities”, “the incident was isolated and contained”, or our personal favorite: “no personal data was exposed”. Unfortunately, the City of Atlanta was a recent example to make headlines after being served with a menacing ransomware attack identified as SamSam. Follow along as the Arrow Payments team covers the sophisticated hack and demonstrates how the fallout can escalate severely when applied to a university campus.
Don’t skip class before the pop-quiz
What happens when a city’s entire digital ecosystem is besieged by ransomware? For starters, real estate closings are disrupted, residents are unable to pay their water bills, and internal processes are shifted backwards into manual transmission.
But what happens when ransomware strikes a city and it is later discovered that the incident was forewarned and preventable? Besides for being on the receiving end of resounding ‘I told you so’s, the reputational costs begin to add up. In other words, the bare minimum cost of a ransomware attack at any affected organization includes money, time, and hard-earned clout.
Stranger danger
The parasitic nature of the SamSam attack, a specific type of ransomware, adds to the seriousness of the situation. Unlike opportunistic tactics that primarily rely on manipulation, this breed of ransomware spreads across a vulnerable system quickly, and then latches itself upon files with unbreakable encryption. As Atlanta Mayor Keisha L. Bottoms puts it, dealing with such a ransomware attack is like “dealing with a hostage situation”.
Path of least resistance
All institutions are at risk for ransomware attacks, and as we’ve heard before, universities are being singled out. Why? Treasurers and hackers are both well aware of the value of a university’s ecosystem, which encompasses student identities, employee records, donor transaction information, and academic research. What makes matters worse is that higher education is especially vulnerable due to its collaborative culture and siloed departments.
Just last year, the world-renown University College London (UCL) was hit by a crippling “zero-day attack” of ransomware, shutting down student management systems while eliciting the suspension of hospital trust email servers. The news coverage was unforgiving as well, as one BBC article highlighted how the university was previously considered a “centre of excellence in cyber-security research”, yet blamed the incident on phishing emails only to later suggest that “it was more likely to be from contact with a ‘compromised’ website”.
Group take-home test
Ransomware is scary, yes, but we believe that you don’t have to shoulder it alone. Find out how your university can work with us to build P2PE-secure solutions that are PCI-compliant, defending against the most sophisticated of ransomware attacks:
