Chapter 11. Extortion
Hundreds of thousands of patient records went up for sale on “TheRealDeal” dark market in July 2016. There, a cybercriminal group that went by the name “TheDarkOverlord” (TDO) offered three databases to anyone who would pay the (hefty) price:1
1. Dissent, “Quest Records LLC Breach Linked to TheDarkOverlord Hacks; More Entities Investigate If They’ve Been Hacked,” DataBreaches.net, August 15, 2016, https://www.databreaches.net/quest-records-llc-breach-linked-tothedarkoverlord-hacks-more-entities-investigate-if-theyve-been-hacked.
“Healthcare Database (48,000 Patients) from Farmington, Missouri, United States.” Price: 151.96 bitcoins (approx. $97,000 at the time)
“Healthcare Database (397,000 Patients) from Atlanta, Georgia, United States.” Price: 607.84 bitcoins (approx. $388,000 at the time)
“Healthcare Database (210,000 Patients) from Central/Midwest United States.” Price: 321.71 bitcoins (approx. $205,000 at the time)
It was far from an isolated incident. TDO regularly hacked into organizations, stole their data, and then threatened to expose it to the world unless the victims paid a steep ransom. If an organization didn’t pay, TDO would sell the data, wait for a period of time to give the buyer the opportunity to use it, and then ultimately publish it for the world to see.
Once the data was published, the hacked organization suffered painful consequences. Patients were angry and blamed the healthcare facility. Sordid news stories came out, embarrassing leadership and damaging organizations’ reputations. In many cases, the exposure triggered a reportable data breach under state or federal laws, resulting in investigations and potential fines.2 This, of course, made the criminals’ future threats all the more credible.
2. Dissent, “Extortion Demand on Athens Orthopedic Clinic Escalates as Patient Data is Dumped,” DataBreaches.net, August 3, 2016, https://www.databreaches.net/extortion-demand-on-athens-orthopedic-clinic-escalates-as-patient-data-is-dumped.
“I delete everything I have once a victim pays,” promised TDO in an interview. “I also supply a report regarding the results and the documentation of my attack. A little token of gratitude and support.”3
3. Dissent Doe, “655,000 Patient Records for Sale on the Dark Net after Hacking Victims Refuse Extortion Demands,” Daily Dot, June 27, 2016, https://www.dailydot.com/layer8/655000-patient-records-dark-net; Dissent, “Quest Records.”
True or not, many victims succumbed to TDO’s extortion schemes, paying hefty fees in exchange for the criminals’ promise of deletion and silence. Along the way, TDO took steps to frighten and cajole their victims into complying. Tactics included partial data dumps with threats of more, public jabs at the victim organization via Twitter, and even personal messages to staff and data subjects in the affected organizations.
The criminals leveraged knowledge of U.S. federal and state cybersecurity laws in their threats against victim organizations. For example, they knew full well that HIPAA-regulated executives feared the negative publicity, fines, and investigations that would result from a data breach. “We’ve recently had the pleasure of . . . acquiring 3.5k patient records that contain both PII [personally identifiable information] and PHI [protected health information],” wrote TDO, as they published a sample of stolen data from a small Manhattan dental clinic. “As proof that what we say is true, you will find below a link to sample of the data. Note that they contain PHI. Their records show that some patients have HIV, AIDS, Herpes Simplex, or Venereal Disease, and much more.”
Unfortunately, the tormented dental clinic was hardly alone. In June 2017, TDO began “playing a game” called “A Business a Day,” where they leaked data stolen from a different company each day. The criminals started by leaking 6,000 patient records from a Los Angeles medical practice and followed the next day with another 6,300 from a Beverly Hills optical clinic. “We love PII. Especially PII of celebrities” said the hackers’ Twitter feed.4
4. Dissent, “They View It as ‘Hollywood,’ but TheDarkOverlord Hit Another Medical Entity (Update 2),” DataBreaches.net, June 21, 2017, https://www.databreaches.net/they-view-it-as-hollywood-but-thedarkoverlord-hit-another-medical-entity.
TDO purposefully used the media as a means of pressuring victims into paying. Much like WikiLeaks, the group’s Twitter followers quickly grew to include mainstream reporters, ensuring that every new data exposure was distributed to the mainstream media. “Every time I put a new listing up it gets reported without hesitation now,” a TDO representative bragged to Motherboard magazine.
In addition to extorting healthcare providers, TDO terrorized school districts, IT companies, media distributors (famously including Netflix), law firms, accountants, manufacturers, police departments, and more.5
5. Dissent, “Irony: When Blackhats are Our Only Source of Disclosure for Some Healthcare Hacks (Update1),” DataBreaches.net, June 24, 2017, https://www.databreaches.net/irony-when-blackhats-are-our-only-source-of-disclosure-for-some-healthcare-hacks; @thedarkoverlord, “Tweets,” Twitter, accessed October 13, 2018, https://twitter.com/tdo_hackers.
“The country is under siege right now,” said Dr. Jay L. Rosen, CEO of the Tampa Bay Surgery Center (another TDO victim).6
6. Tim Johnson, “How TheDarkOverlord is Costing U.S. Clinics Big Time with Ransom Demands,” Kansas City Star, May 15, 2017, http://www.kansascity.com/news/nation-world/article150679092.html.
The cyber extortion problem was even worse than news reports revealed. There was ample evidence that many of the victims paid to keep the breaches quiet and therefore remained uncounted.
11.1 Epidemic
By 2016, cyber extortion was widespread. Ransomware—malicious software that encrypts data and holds it hostage until the victim pays a fee—affected more than 2.3 million users worldwide.7 Criminal gangs routinely hacked into organizations, stole data, and then threatened to expose it, extracting large payments in exchange for keeping quiet.
7. “KSN Report: PC Ransomware in 2014-2016,” Kaspersky Lab, June 22, 2016, https://securelist.com/pc-ransomwarein-2014-2016/75145/.
11.1.1 Definition
Cyber extortion is when an attacker threatens to damage the confidentiality, integrity, or availability of information unless he or she receives a payment or other desirable outcome. Types of cyber extortion include:
Denial - Data is rendered unavailable until the desired outcome is achieved.
Modification - Attackers threaten to alter sensitive data unless the desired outcome is achieved.
Exposure - Attackers impact the confidentiality of information, threatening to publish or share sensitive data unless the desired outcome is achieved.
Faux - The extortion attempt is merely a ruse designed to obscure the attacker’s true purpose.
Of these four types, denial and exposure extortions are by far the most common.
Modification extortion is still largely theoretical, but a frightening concept. “Imagine, mixing together all patients’ medications in a hospitals, or their blood results or their radiology images,” writes medical doctor and cybersecurity consultant Saif Abed, considering the potential for a “Clinical Integrity Extortion” attack. “[I]magine that clinicians often not having time to second guess what they see on their screens. . . . [I]t’s a disaster.”8
8. Saif Abed, “The Clinical Integrity Extortion (CIE) Attack: A Healthcare Cyber-Nightmare,” Medium, September 14, 2018, https://medium.com/@s.abed86/the-clinical-integrity-extortion-cie-attack-a-healthcare-cyber-nightmare-3c74f61f5b5d.
Each type of extortion requires a different response, as we will see throughout this chapter.
11.1.2 Maturation
Cyber extortion became an epidemic because of the maturation of specific technologies, laws, and cybersecurity standards, including:
Cryptocurrency, which gave criminals an easy way to demand quick, anonymous payments in extortion cases.
Crimeware for exploitation and extortion, which evolved to the point where even less-savvy users could purchase a commercial exploit kit or ransomware software and point-and-click their way to success.
Data breach laws and standards. In the United States, by 2016, the Health Insurance Portability and Accountability Act (HIPAA) had teeth, and most states had data breach notification laws. Criminals used these regulations to incite fear in their victims, specifically targeting regulated data and highlighting it in extortion threats.
The result of these advancements was that cyber extortion became a quick and low-risk crime to commit. Furthermore, organizations that publicly reveal that they have been hacked can suffer devastating reputational damage and incite widespread anger—and some are willing to pay a hefty ransom to avoid that.
In the rest of this chapter, we will explore the three most common types of cyber extortion and discuss response strategies for each.
11.2 Denial Extortion
Denial cyber extortion occurs when an attacker prevents legitimate users from accessing information assets until they take action, such as paying a fee. In this section, we will focus on ransomware, the most common form of denial extortion.
11.2.1 Ransomware
Ransomware is software designed to lock up user files or entire operating systems in exchange for a fee. Modern ransomware outbreaks commonly begin in one of two ways:
Phishing: The attacker sends a phishing email or social media message to an employee. The employee clicks on the link, which infects a workstation with malware.
Remote login: Attackers scan the Internet searching for remote login interfaces with default or weak account credentials. Once obtained, they can access the systems themselves or sell access to other criminals.
Once the attacker installs ransomware, typically:
The ransomware encrypts files on the local computer, as well as writable network shares and accessible cloud storage repositories. Depending on what files the user has access to, this can prevent him or her from accessing a large volume of valuable data, potentially crippling operations.
An electronic “ransom note” appears on the user’s desktop or screen, notifying the user of the encryption and providing the user with an opportunity to purchase decryption keys. Often, a deadline is included, after which the price for the decryption keys increases substantially. Some strains of ransomware also permanently delete files periodically (e.g., every hour).
If the victim pays the ransom, the criminal (theoretically) provides a decryption key, which will allow recovery of all or part of the volume of affected files.
Ransomware can wreak havoc, particularly if it spreads through an organization’s network. In addition to denying access to the victim’s data, attackers may steal or access sensitive information, which means that a ransomware infection may also constitute a data breach. Even if the operational impacts are short lived, the fallout from the data breach aspect may be long term and significant.
11.2.2 Encryption and Decryption
The first known ransomware, the AIDS Trojan, was released in 1989 by biologist Joseph Popp, who studied baboons in East Africa. He distributed the AIDS Trojan by mailing a floppy disk labeled “AIDS Information - Introductory Diskettes” to 20,000 AIDS researchers across 90 countries. After 90 reboots, the malware hid directories and encrypted filenames, and instructed victims to send $189 to a P.O. box in Panama in order to obtain a repair tool. The malware had a critical flaw, however: It used symmetric key cryptography, meaning the same key was used to encrypt and decrypt. Moreover, the key was the same for all victims, and defenders quickly developed decryption tools.9
9. Alina Simone, “The Strange History of Ransomware,” March 26, 2015, Medium.com, https://medium.com/unhackable/the-bizarre-pre-internet-history-of-ransomware-bb480a652b4b.
In late 2004, modern ransomware emerged and began to spread via phishing and web-based attacks. This early ransomware was clunky and often had deficiencies that allowed savvy users to bypass the malicious software and regain access to their data without paying a fee. For example, Kaspersky10 Labs reported encountering a new malware strain called GPCode, which encrypted files and left behind a ransom note that instructed the victim to “buy our decryptor” by contacting the attacker at a Yahoo email address. The researchers found that GPCode was likely of Russian origin and used a custom-written encryption algorithm that was easy to break. The author quickly fine-tuned the malware and released new, stronger variants, eventually switching to the strong RSA encryption algorithm.
10. Denis Nazarov and Olga Emelyanova, “Blackmailer: the story of Gpcode,” SecureList, June 26, 2006. https://securelist.com/blackmailer-the-story-of-gpcode/36089 (accessed June 6, 2019).
Over the next several years, ransomware authors experimented with different models of extorting money from victims, including fake antivirus scans, which locked the user’s computer and posted a warning on the screen requiring the user to call to “activate” the antivirus license. This evolved into law-enforcement-themed locker ransomware, which locked the victim’s computer and posted a notice from law enforcement that accused the user of downloading pirated data or viewing pornography. The victim was told to “pay a fine” in order to have the computer unlocked. “[I]n the early days, attackers tricked victims into downloading fake tools to fix computer issues,” wrote Symantec researchers. “Eventually, it dropped any pretense of being a helpful tool to just displaying a blatant request for payment to restore access to the computer.”11
11. Kevin Savage, Peter Coogan, and Hon Lau, “The Evolution of Ransomware” (whitepaper, Symantec, Mountain View, CA, August 6, 2015), 10, http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-evolution-of-ransomware.pdf.
In some cases, ransomware strains delete but do not overwrite the original files, enabling forensic analysts to use common file recovery software to restore the original content. Another recovery tactic is to attempt to reverse-engineer the decryption key. If an analyst has access to both encrypted files and a sample of the original, nonencrypted files, then in some cases it may be possible to use cryptographic techniques to determine the key. However, this takes time and computing power, if it is possible at all.
Over time, ransomware developers refined their software and processes. Ultimately, they found that asymmetric cryptography was an effective means of rendering victims’ files inaccessible. Attackers encrypted the victim’s files with one key and held the corresponding decryption key hostage until they received payment. (See § 5.3.2 for details on asymmetric cryptography.) When implemented carefully, it is virtually impossible for victims to recover their files without a backup.
CryptoLocker was one widespread ransomware variant that emerged in 2013 and leveraged strong encryption (researchers observed it using the popular RSA algorithm with up to 2048-bit keys). It also overwrote the original files, rendering them impossible to recover even for forensics experts.12 In 2014, a team of law enforcement agencies and security firms infiltrated the botnet used to spread CryptoLocker and captured a huge database of private keys, enabling many victims around the world to finally decrypt their data.
12. “CryptoLocker: What Is and How to Avoid It,” Panda Security, May 14, 2015, https://www.pandasecurity.com/mediacenter/malware/cryptolocker/.
Today, many reputable security firms have released tools that can decrypt popular ransomware strains, either leveraging implementation issues or available private keys. Sites such as NoMoreRansom.org can help defenders determine their ransomware strain and quickly obtain decryption utilities. While there is no guarantee that these tools will be successful, it is often worth trying as a first step.
11.2.3 Payment
Before cryptocurrency existed, it was difficult for cybercriminals to extort payments over the Internet. Cybercriminals attempted to collect payment using wire transfers, payment voucher systems such as MoneyPak or paysafecard, or more creative methods such as text messages to premium phone numbers. All of these payment transfer systems were brokered by a third party and could potentially leave a trail that would help law enforcement track down the attacker. As a result, criminals typically used a money-laundering service in conjunction with a money transfer method.13
13. Savage, Coogan, and Lau, “Evolution of Ransomware,” 22–25.
The rise of Bitcoin gave criminals a new, convenient option. When CryptoLocker erupted in 2013, it accepted payment using either Bitcoin or prepaid cash voucher. Victims in the United States were typically given 72 hours to pay the equivalent of $300. The ransom note warned that the victim’s decryption key would be destroyed when the deadline passed, rendering the files permanently unrecoverable. However, victims reported that they could still purchase the key even after the deadline—at a much higher price.
Cryptocurrency dramatically reduced the risk of engaging in cyber extortion, which in turn caused the crime to proliferate. By 2014, a wide range of ransomware had sprung up that instructed bewildered victims to pay using cryptocurrency. Since most nontechie users were not familiar with Bitcoin, ransomers often left user-friendly, detailed instructions that walked the victim through the process of purchasing and transferring cryptocurrency.14
14. Brian Krebs, “2014: The Year Extortion Went Mainstream,” Krebs on Security (blog), June 26, 2014, https://web.archive.org/web/20140702112204/ http://krebsonsecurity.com/2014/06/2014-the-year-extortion-went-mainstream.
At first, the majority of cryptocurrency ransom demands were relatively small, on average about $300. Criminals soon realized, however, that when they locked up an organization (as opposed to an individual), they had leverage to extort far larger sums of money. For example, in 2015 the Swedesboro-Woolwich School District in New Jersey was held hostage for 500 bitcoins (approximately $124,000 at the time).15 This trend became more widespread, particularly as more and more organizations purchased cyber insurance that covered large ransom payments.
15. Rebecca Forand, “School District ‘Bitcoin Hostage’ Situation Continues; FBI, Homeland Security Investigating,” NJ.com, March 24, 2015, http://www.nj.com/gloucester-county/index.ssf/2015/03/school_district_bitcoin_hostage_situation_continue.html.
In 2018, sophisticated ransomware evolved that encrypted individual file shares and devices with different keys (“key differentiation”). That meant criminals could charge victims money to recover each individual file share or storage device.16
16. Sherri Davidoff, “Cyber Alert: New Ransomware Holds Individual File Shares Hostage,” LMG Security, May 16 2018, https://lmgsecurity.com/cyber-alert-new-ransomware/.
11.2.4 World Domination
By the close of 2015, ransomware had become a dominant threat. “Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today,” observed Symantec researchers in their 2016 Internet Security Threat Report.17
17. Lucian Constantin, “New Ransomware Program Threatens to Publish User File,” Computerworld, November 5, 2015, https://www.computerworld.com/article/3002120/security/new-ransomware-program-threatens-to-publish-user-files.html; Symantec, “2016 Internet Security Threat Report,” ISTR 21 (April 2016): 58, https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf.
The Center for Internet Security dubbed 2016 “The Year of Ransomware.”18 In February 2016, Hollywood Presbyterian Hospital in Los Angeles was famously shut down by ransomware, generating an intense media storm. The hospital ended up paying $17,000 to the hackers in exchange for recovering its data.19 The following month, Methodist Hospital in Kentucky was forced to declare an “internal state of emergency” after ransomware encrypted files throughout its IT infrastructure.
18. Katelyn Bailey, “2016: The Year of Ransomware,” Center for Internet Security (blog), 2016, https://www.cisecurity.org/blog/2016-the-year-of-ransomware/.
19. John Biggs, “LA Hospital Servers Shut Down by Ransomware,” Tech Crunch, February 17, 2016, https://techcrunch.com/2016/02/17/la-hospital-servers-shut-down-by-ransomware.
As the ransomware epidemic spread, cybercriminals took over computer systems around the world, including hospitals, schools, police stations, and more. When a ransomware infection was found, local IT staff typically worked to clean off the malware and restore data as quickly as possible. Victims rarely reported ransomware incidents to the public voluntarily, but in severe cases where day-to-day operations were impacted, word spread.
Within a few years, commercial ransomware software became a popular product on the dark web. Criminals could purchase turnkey malware, distribute it using common exploit kits, and rake in profits. To make it even easier, many vendors peddled “ransomware-as-a-service,” where customers on the dark web paid a fee to rent ransomware platforms, which often provided user-friendly dashboards and easy-to-understand instructions.
11.2.5 Is Ransomware a Breach?
Victims traditionally took a “wishful thinking” approach to ransomware, assuming that even though attackers had locked up their data, they hadn’t actually taken it. In the case of the Swedesboro-Woolwich School District, the superintendent reassured the public that the confidentiality of student data was not at risk. “Ransomware is more like an octopus,” he said. “Its tentacles wrap around your data. There’s no destruction or extraction.”21
21. Forand, “School District.”
In keeping with this philosophy, most organizations treated ransomware exclusively as an operational issue. When an infected system was discovered, IT staff worked diligently to clean it, restore the data, and move on. “Because ransomware is so common, hospitals aren’t reporting them all,” said James Scott, senior fellow at the Institute for Critical Infrastructure Technology.22
22. Jessica Davis, “Ransomware Rising, but Where Are All the Breach Reports?” Healthcare IT News, March 20, 2017, http://www.healthcareitnews.com/news/ransomware-rising-where-are-all-breach-reports.
Reality eventually caught up. Breach coaches who managed incidents realized that if an attacker had access to encrypt a victim’s data, the cybercriminal could well have stolen it, too. And why not? Criminals could resell sensitive data on the black market and make money from denial extortion. To that end, ransomware developers added data-stealing capabilities to ransomware strains. For example, Cerber and Spora ransomware samples were updated to include keystroke loggers and password theft functionality. “By stealing credentials from victims, criminals are ensuring a double payday, because not only can they make money from extorting ransoms, they can also potentially sell stolen information to other criminals on underground forums,” reported Danny Palmer of ZDNet.23
23. Danny Palmer, “Ransomware 2.0: Spora Now Steals Your Credentials and Logs What You Type,” ZDNet, August 24, 2017, http://www.zdnet.com/article/ransomware-2-0-spora-now-steals-your-credentials-and-logs-what-you-type.
Ransomware is often the most visible sign of a compromise—but not the only component. Attackers frequently lurk in an organization’s systems for months or years, stealing data or renting bots, before deciding to quickly monetize access by installing ransomware.
In 2016, the OCR caused waves throughout the healthcare industry by unequivocally stating that ransomware attacks should be treated as breaches. They published a “fact sheet” on ransomware and HIPAA, clearly stating that “when electronic protected health information (ePHI) is encrypted as the result of a ransomware attack, a breach has occurred because the ePHI encrypted by the ransomware was acquired.” That means that ransomware incidents should be treated as potential data breaches and must be reported unless the covered entity can demonstrate a “low probability” that PHI was compromised, as per the four-factor risk assessment outlined in the HITECH Breach Notification guidelines.24 (For a detailed discussion about data breaches and the healthcare industry, see Chapter 9, “Health Data Breaches.”)25
24. U.S. Department of Health and Human Services, “Fact Sheet: Ransomware and HIPAA,” accessed January 18, 2018, https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf?language=es.
25. U.S. HHS, “Factsheet.”
For other types of data, it’s not always clear whether ransomware constitutes a data breach. The level of investigation and conclusions vary considerably based on the experience and risk tolerance of the breach coach and victim organization. It is always wise to retain a sample of the malware whenever possible, so that forensic analysts can assess its capabilities if needed.
11.2.6 Response
Responding to ransomware can be a painful and traumatic experience. There is typically little or no warning, and when ransomware hits, it can cause major damage. The DRAMA model of data breach management applies, as described in Chapter 4, “Managing DRAMA”:
DEVELOP your data breach response function.
REALIZE that a potential data breach exists by recognizing the signs and escalating, investigating, and scoping the problem.
ACT quickly, ethically, and empathetically to manage the crisis and perceptions.
MAINTAIN data breach response efforts throughout the chronic phase and potentially long-term.
ADAPT proactively and wisely in response to a potential data breach.
In ransomware cases, there are distinct issues that response teams should consider during the develop, realize, and act phases. These include:
Include ransomware in data breach planning. All too often, organizations plan for the operational impacts of ransomware but forget to consider that it may also legally qualify as a data breach. A common result of this oversight is that critical evidence is not preserved during the immediate response to ransomware, making it impossible to rule out a data breach later.
Preserve evidence early on. Make sure that first responders are trained to recognize ransomware as a potential data breach. Preserve important evidence such as the malware sample whenever possible, so that if needed, forensic analysts can later analyze it to determine whether the malware is capable of exfiltrating data or is designed to simply deny access. If ransomware is widespread and it is not feasable to perform a full forensic acquisition of all affected computers, prioritize based on volume and sensitivity of the data stored on each system.
Activate crisis communication plans quickly. Since ransomware can have a sudden and dramatic impact on an organization’s operations, news of the infection can become widely known very quickly. This is especially true for organizations that suffer a widespread infection that impacts public-facing services (as in hospitals and local government agencies).
Manage both the operational and data breach impacts of the crisis. It can be challenging to manage a potential data leak while also working to restore operations. Consider, in advance, how to divide up the work and ensure that both issues are addressed.
In the “Act” phase, ransomware-specific crisis management steps include:
Assess the Damage - Take an inventory of what data has been encrypted, and determine whether the organization can recover the data from backups, recreate missing data, or function without certain data sets.
Recover from Backups - If available, restore as much data as possible from backups (after preserving appropriate evidence, of course).
Check for a Decryptor - Technical experts can examine the encrypted systems to determine whether there is a known bypass—some way to unlock the files without paying to get the decryption key from the attackers.
Negotiate and Pay the Ransom - If all else fails, then the organization may be stuck with a hard choice: pay to get the decryption key (which is not guaranteed to work) or fully rebuild, which in severe cases could threaten the viability of the organization. See the next section for a discussion of negotiation and payment in ransomware cases.
Fully Rebuild - Many organizations choose (or are forced) to start from scratch, rebuild affected systems, and recreate lost data. This can be a painful, time-consuming, and expensive process.
11.2.6.1 Negotiation Tips
In ransomware cases, as in real-life hostage negotiations, you may need to come to an agreement with the extortionists regarding payment. Certain tactics can help increase your chances of a positive outcome. For example:
Demand “proof of data.” Before paying for a decryption key or tool to recover your data, make sure that the extortionists can actually deliver. Particularly in high-dollar cases, you can request that the ransomers send samples of decrypted files to ensure that they can actually fulfil their end of whatever deal you strike.
Act calmly, reasonablely, and logically. Criminals are more likely to successfully negotiate with you if you build trust during your conversations and approach the discussion as a straightforward business deal rather than an emotionally charged situation.
Don’t make unrealistic promises. If you’re not sure that you can pay or the dollar amount is genuinely too high, be straightforward. When criminals get annoyed by unmet expectations, they are more likely to retaliate or abandon the negotiation entirely.
Take a team approach. As odd as it sounds, your organization and the extortionist have a mutual interest in reaching agreement. Leverage this in your conversations. Security consultant Hussam Al Abed recommends, “Use the word ‘we’ to encourage your captors to think of you as sharing mutual concerns. You do have a common interest in the outcome of this situation.”26
26. Hussam A Al-Abed, “Extortion/Kidnapping Checklist,” BankersOnline.com, July 21, 2003, https://www.bankersonline.com/qa/extortionkidnapping-checklist.
At the same time, certain classic rules of hostage negotiation need to be rethought when it comes to ransomware. Unlike real-life hostage situations, the criminals behind ransomware do not have possession of a physical human being who needs to be fed, monitored, and kept alive in order to maintain leverage. Instead, perpetrators of ransomware can take over dozens of organizations and maintain their control with little ongoing effort.
The result is that cybercriminals have less incentive to close deals; they can store decryption keys for months or years if needed—or delete them on a whim. Consultants trained in real-life hostage negotiation tactics may be surprised to find themselves at a disadvantage in ransomware cases. Common wisdom is to reject the extortionists’ first offer—a tactic that can backfire when dealing with cookie-cutter ransomware, where criminals may focus their time on easy money and ignore more complex discussions.
In addition, ransom notes often include a deadline after which files are automatically deleted or the ransom payment goes up. Victims that exceed this deadline due to negotiation attempts may find that they are unable to recover certain files as a result, or they end up paying a higher ransom due to the delay.
11.3 Exposure Extortion
Just as ransomware reached epidemic proportions, criminals perfected modern data exposure tactics. For example, in 2016, the Panama Papers emerged as the largest data leak ever and was an important milestone in the development of the megaleaks phenomenon. That same year, the U.S. 2016 presidential elections were underway—and with them came a series of sophisticated, highly publicized data breaches that changed global politics forever.
Criminals realized that they could marry exposure and extortion tactics, resulting in a new type of data breach epidemic that struck fear in organizations around the globe: exposure extortion. They hacked into computers and threatened to publish sensitive information unless the victim paid a fee or took action. If the victim acquiesed, then (the criminals promised) they would delete the information and keep quiet. Of course, there was no guarantee that the criminals actually did delete the stolen data, and plenty of evidence to suggest that many sold it on the dark web while also holding the victim organizations for ransom.
Exposure extortion is almost always a data breach, in the colloquial sense if not the legal sense. Attackers typically obtain sensitive information by hacking into an organization’s IT systems. Even if the victim pays the ransom and the stolen data remains unpublished, it is still the case that an unauthorized party aquired it, and (depending on the data type) this fact alone can trigger state and national data breach notification laws. Because of this, organizations that choose to pay the ransom and remain quiet may place themselves in legal jeopardy and risk the wrath of regulators and consumers if the data breach is later uncovered.
To maximize impact, criminals often target data that is regulated (such as PHI or PII), intimate, or exceptionally valuable to an organization (such as a company’s core intellectual property). In this section, we will discuss different types of exposure extortion cases, review strategies for response, and delve into a case study as illustration.
11.3.1 Regulated Data Extortion
Regulated data is typically regulated for a reason: because it is easy to use for fraud or to shame or embarrass an individual. Common types of regulated data in the United States include (but are not limited to):
Personally identifiable information (PII) - Name, address, phone number, Social Security number (SSN), etc. “Personally identifiable information” and similar terms are defined in a variety of state and federal laws (there is no single universal definition).
Health information - Medical records, treatment and diagnosis, healthcare billing information, and a variety of other personal details (see Chapter 9, “Health Data Breaches,” for details on HIPAA and state health information laws).
Student educational records - Grades, disciplinary records, student medical treatment, information about learning disabilities and other physical or psychological issues, and more. In the United States, the Family Educational Rights and Privacy Act of 1974 (FERPA) protects the privacy of education records for students of federally funded institutions.
As breach notification laws became widespread, it increased the likelihood that a data breach involving regulated information would result in fines, investigations, and widespread public outcry from the affected communities. This placed pressure on IT staff and management to invest in security.
Unfortunately, extortionists have learned to twist breach notification laws to their advantage, using the spectre of investigations, lawsuits, and angry stakeholders to frighten management of these organizations into caving to their demands. Ironically, as the public grew to better understand cybersecurity issues, the potential for reputational damage due to a data breach increased, putting even more pressure on organizations to sweep data breaches under the rug.
Given the high concentration of regulated data in hospitals and schools (and the relatively low budget for security compared with financial institutions), these organizations have become popular targets for extortionists.
11.3.1.1 School Districts
In 2017, TDO claimed responsibility for extorting school districts in Iowa, Montana, and Texas. (Many other cases may have occurred outside the public spotlight since cyber extortion cases are often handled very quietly.)27 “Imagine if we published all of your sensitive behavioural reports from your counselors and social workers on the open internet,” they threatened in one school district’s ransom note. “Imagine if we published student grades and even the shoddy student work. How about nurse reports and private health information? What would the parents have to say about this? What sort of lawsuits would they begin? What would happen if everyone found out the reason we closed down multiple districts and over thirty sites is due to your failure to secure your networks?”28
27. Valerie Strauss and Moriah Balingit, “Education Department Warns of New Hacker Threat as ‘Dark Overlord’ Claims Credit for Attacks on School Districts,” Washington Post, October 26, 2017, https://www.washingtonpost.com/news/answer-sheet/wp/2017/10/26/education-department-warns-of-new-hacker-threat-as-dark-overlord-claims-credit-for-attacks-on-school-districts/; Ms. Smith, “Dark Overlord Hacks Schools across U.S., Texts Threats against Kids to Parents,” CSO, October 9, 2017, https://www.csoonline.com/article/3230975/security/dark-overlord-hacks-schools-across-us-texts-threats-against-kids-to-parents.html (accessed December 9, 2018).
28. “Cyberthreat Closes Schools,” Petronella Technology Group, accessed June 3, 2019, https://petronellatech.com/cyberthreat-closes-schools/.
The criminals demanded a $150,000 ransom, payable in installments over a one-year period, or $75,000 if the school district paid the entire sum immediately.
To really turn the screws on their victims, TDO used stolen contact information to communicate directly with data subjects themselves. In the Iowa school district case, the criminals sent death threats to parents. One mother received a text from the cybercriminals that read, creepily: “The life of a precious young child is so precious.” The communications often included detailed information, such as childrens’ names and home addresses. In response, many parents kept their children home from school, and some school districts shut down in the days following the attack.
“I wanted the public to exist in a state of fear before I make my move,” explained a spokesperson for TDO. “This will allow the government protecting your children to look poorly in the light of the public.”29
29. Smith, “Dark Overlord Hacks Schools.”
11.3.1.2 Healthcare
The case of Athens Orthopedic Clinic (AOC) illustrates how cyber extortionists use sophisticated public relations tactics to stoke the public’s anger and use it to pressure management into paying. This is especially effective when a case involves highly sensitive data such as health information. In June 2016, TDO hacked the clinic and demanded 500 bitcoins as ransom (approx. $329,000 at the time). Apparently AOC opted not to pay.
“[P]aying ransom does not guarantee any further criminal activity will not take place,” a spokesperson for AOC later explained.30
30. Dissent, “Extortion Demand on Athens Orthopedic Clinic Escalates as Patient Data is Dumped,” DataBreaches.net, August 3, 2016, https://www.databreaches.net/extortion-demand-on-athens-orthopedic-clinic-escalates-as-patient-data-is-dumped.
In response, TDO turned up the heat—by going public. The criminals posted a sample of the stolen data—500 patients’ records—on Pastebin, along with a public demand for payment.31 Based on the leaked samples, the stolen databases included fields such as name and address, gender, SSN, health insurance details, and more. Additional screenshots from the stolen data dumps showed that the criminals had access to full medical records, including diagnoses, prescription history, appointments, and surgeries.32
31. Dissent, “Extortion Demand on Athens.”
32. Dissent Doe, “655,000 Patient Records.”
Days later, AOC publicly acknowledged the breach for the first time (despite the fact that AOC management had reportedly known about the breach for a month). “We did not make any public disclosure of the breach at that time so as not to interfere with their investigation or push the hacker into a mass public release of data,” explained the clinic, in a statement on its website.33 By late July 2016, AOC had reported the breach to the OCR and began mailing breach notification letters to affected patients.34
33. “Important News for Patients,” Athens Orthopedic Clinic, accessed January 18, 2018, http://athensorthopedicclinic.com/important-news-patients.
34. “Breach Notification,” Athens Orthopedic Clinic, August 2016, https://web.archive.org/web/20171115112741/ http://ath-cdn.com/sites/default/files/AOC%20letter.pdf; Dissent, “Athens Orthopedic Clinic to Begin Notifying Patients of Hack (UPDATE2),” DataBreaches.net, July 25, 2016, https://www.databreaches.net/athens-orthopedic-clinic-to-begin-notifying-patients-of-hack.
With the ransom demand still unpaid in early August, TDO leaked an additional 1,500 records, with a message directed personally at CEO Kayo Elliott: “Pay up, Kayo.”35
35. “Screenshot of Athens Orthopedic Clinic PII/PHI Leak #3,” DataBreaches.net, August 17, 2016, https://www.databreaches.net/wp-content/uploads/ScreenshotAOC2016-8-17.jpg.
The criminals were all too happy to disparage their victim in interviews and on social media. “It was like stealing candy from a baby,” said a TDO representative, who revealed that the group had broken into a popular Electronic Health Record (EHR) software product and used it to download the patient records from AOC. According to the clinic, the hackers initially gained remote access using the credentials of a “third-party vendor” that was a “nationally-known healthcare information management contractor.”36 As we saw in Chapter 9, vendor remote access is often a weak spot in healthcare clinic security postures.
36. Jim Thompson, “Athens Orthopedic Won’t Pay for Extended Credit Monitoring in Data Breach,” OnlineAthens, August 12, 2016, http://www.onlineathens.com/mobile/2016-08-12/athens-orthopedic-wont-pay-extended-credit-monitoring-data-breach.
TDO publicly claimed it was still in AOC’s systems throughout June and July, chastising clinic staff in emails that were later shared with a journalist:37
37. Dissent, “Athens Orthopedic Clinic Incident Response Leaves Patients in the Dark and Out of Pocket for Protection,” DataBreaches.net, August 15, 2016, https://www.databreaches.net/athens-orthopedic-clinic-incident-response-leaves-patients-in-the-dark-and-out-of-pocket-for-protection.
You have done little to mitigate against an advanced attacker. . . . It is now over two weeks later, and the passwords are still not changed. Let’s just use the PACS imaging system as an example here. We just logged in a few minutes ago. Even after telling you directly which systems were compromised, nothing has been done to correct the issue.
Unfortunately, the clinic was woefully unprepared to launch an effective public relations campaign in response. For example, in a surprising departure from the norm, AOC elected not to provide free credit monitoring for affected patients—a move that inflamed public ire. Elliott said, “We are not able spend the many millions of dollars it would cost us to pay for credit monitoring for nearly 200,000 patients and keep Athens Orthopedic as a viable business.”38 An attorney representing AOC stated that the organization did not have insurance that would cover “cyber-related losses.”39 The clinic recommended that affected patients place a fraud alert on their credit reports and provided a toll-free number patients could use to contact that clinic to discuss the breach.40
38. Thompson, “Athens Orthopedic Won’t Pay.”
39. Dissent, “Athens Orthopedic Clinic Incident Response.”
40. John Fontana, “Clinic Won’t Pay Breach Protection for Victims; CEO Says It Would Be Death Of Company,” ZDNet, August 16, 2018, https://www.zdnet.com/article/clinic-wont-pay-breach-protection-for-victims-ceo-says-it-would-be-death-of-company/.
Patients were furious. “They are assuming no responsibility for this financially,” said one client, Marianne Causey. “I guess I just trusted them to take care of us better.”41
41. Fontana, “Clinic Won’t Pay.”
Many questioned AOC’s reported lack of insurance coverage. By 2016, cyber insurance had become a well-established best practice for organizations that maintained extensive amounts of personal information. Even the criminals took AOC to task, with the following (sadly insightful) remark: “[T]he year is sixteen past two-thousand and that they should have already had the necessary insurance policies to cover such incidents as this one.”42 (Cyber insurance coverage will be discussed in depth in Chapter 12, “Cyber Insurance.”)
42. Dissent, “Athens Orthopedic Clinic Incident.”
In the AOC case, as in most exposure extortion cases, the criminals attempted to use public perception as a weapon against the breached organization. For this reason, a strong crisis communications plan is a critical part of the response. Since the public has come to expect compensation such as credit monitoring in data breach cases, it is important to have appropriate insurance coverage or budget for this offering, or an alternate, equally effective image repair strategy.
11.3.2 Sextortion
Sex-related information has emerged as a major driver behind extortion cases in recent years. This can take many forms, such as “webcam blackmail,” where an attacker obtains risque or obscene photos or videos of a victim and threatens to publish the images or share them with the victim’s friends or family unless he or she receives a fee.
Criminals soon realized they didn’t actually need footage to extort money from victims. Instead, they sent widespread phishing emails that claimed to have obtained footage of sex acts from the recipient’s webcam, and threatened to release it to all of their contacts. In a more recent twist, the criminals included the victims’ passwords (stolen in other data breaches) in the emails. Many recipients, frightened and ashamed, quietly paid—not realizing the attackers had only their email address; the footage didn’t actually exist.43
43. Brian Krebs, “Sextortion Scam Uses Recipient’s Hacked Passwords,” Krebs on Security (blog), July 12, 2018, https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/.
The Ashley Madison “cheating” website breach illustrated how both a breached organization and the data subjects themselves can become victims of sex-related extortion. The Ashley Madison site was designed to attract married men and women who sought to have affairs. “Thousands of cheating wives and cheating husbands signup everyday looking for an affair,” advertised the site. “With Our affair guarantee package we guarantee you will find the perfect affair partner.”44
44. Kim Zetter, “Hackers Finally Post Stolen Ashley Madison Data,” Wired, August 18, 2015, https://www.wired.com/2015/08/happened-hackers-posted-stolen-ashley-madison-data/.
Hackers broke into the site and demanded that Ashley Madison’s owner, Avid Life Media, take the site offline permanently, or they would publish customer records, “including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.”45 When Avid Life didn’t comply, they published the data as two compressed files on the dark web, where the data was downloaded and circulated around the world.
45. Zetter, “Hackers Finally Post.”
Millions of users had their names, addresses, and other personal details exposed. The BBC reported that two individuals committed suicide as a result of the breach.46 There were 1,200 email addresses with the suffix for “Saudi Arabia,” where adultery is illegal and may be punished by death.47
46. Chris Baraniuk, “Ashley Madison: ‘Suicides’ over Website Hack,” BBC News, August 24, 2015, https://www.bbc.com/news/technology-34044506.
47. Philippe Lopez, “The Global Fallout of the Ashley Madison Hack,” France24, August 20, 2015, https://www.france24.com/en/20150820-global-fall-out-ashley-madison-hack.
After the lists of Ashley Madison users were published, third-party criminals began targeting them with extortion threats. For example, one criminal gang sent mass emails to Ashley Madison users advertising their new site, “Cheaters Gallery,” which they claimed would feature each email recipient. “We will launch the site with a big email to all the friends and family of cheaters taken from Facebook, LinkedIn and other social sites,” the criminals threatened. “This will include you if do not pay to opting out.” The price for “opting out” was approximately $500, payable in bitcoins.48
48. Robin Harris, “Ashley Madison Blackmail Roars Back to Life,” ZDNet, April 24, 2017, https://www.zdnet.com/article/ashley-madison-blackmail-roars-back-to-life/.
One Ashley Madison user who received the email wisely pointed out that paying the ransom guaranteed nothing—in fact, doing so could make you more of a target. “[E]ven if you pay these guys off, they can come back in a couple of months . . . and hit you up again. Wouldn’t surprise me if they sold lists of people foolish enough to pay up to other groups. Once you pay you’ve told them you’re vulnerable to blackmail forever.”49
49. Harris, “Ashley Madison Blackmail.”
As a result of the breach, Ashley Madison was hit with dozens of lawsuits; it ultimately settled its class-action case for $11.2 million.50
50. David Kravets, “Lawyers Score Big in Settlement for Ashley Madison Cheating Site Data Breach,” Ars Technica, July 17, 2017, https://arstechnica.com/tech-policy/2017/07/sssshhh-claim-your-19-from-ashley-madison-class-action-settlement/.
11.3.3 Intellectual Property
Corporate data, too, is targeted by extortionists. Companies that rely heavily on digital intellectual property (such as online gaming vendors, software firms, or media companies) are particularly vulnerable since a sudden release of their intellectual property can threaten their profits or even undermine the value of the entire organization. In this section, we will examine two corporate extortion cases: the Hollywood “Netflix” hack and an early breach of Bloomberg.
11.3.3.1 The ’’Netflix’’ Hack
On Christmas morning in 2016, Hollywood’s Larson Studios learned about cyber extortion the hard way when the company’s husband-and-wife owners, Rick and Jill Larson, received an email from TDO threatening to expose all of their data. The small business handled audio postproduction for major networks, and the stolen data reportedly included dozens of movies and TV shows from ABC, NBC, E!, Fox, FX, IFC, the Disney Channel, Netflix, and more. The criminals demanded 50 bitcoins to keep quiet and destroy the stolen data—approximately $50,000 at the time. If the Larsons didn’t pay, the criminals threatened, they would release the shows, starting with Netflix’s Orange is the New Black.
Fearful of their livelihood, the Larsons filed a police report—and paid the ransom. One factor was TDO’s reputation for upholding its end of the bargain. “They would return the materials, destroy the materials, and it was over,” said Rick Larson. “This was the way they work.” It was an attractive offer: If the Larsons paid the money, it would all be over.
But the Larson’s nightmare was only beginning. By late March, the FBI called to report that the criminals were using the files stolen from Larson to blackmail major networks. The Larsons had never told their clients about the breach, apparently partially due to pressure from the hackers themselves to keep quiet. Suddenly, the business owners found themselves under heavy scrutiny by the security teams from the major studios that they served. It wasn’t just the company’s network that was breached; it was the trust they had built with their clients.
By April, TDO was publicly taunting Netflix on Twitter, demanding a ransom payment to prevent the group from leaking Orange is the New Black. When Netflix didn’t bite, the criminals dumped ten episodes before the scheduled premier.
In the aftermath of the breach, some of the Larsons’ clients left. Major studios that remained required extensive audits and additional security measures. Ironically, despite investing “six figures” on security in response to the breach, Larson Studios continued to fight the perception of insecurity long afterwards.51
51. Janko Roettgers, “Netflix Hackers Could Have Three Dozen Additional TV Shows, Films from Other Networks and Studios,” Variety, April 30, 2017, https://variety.com/2017/digital/news/netflix-hackers-additional-shows-movies-1202404171/; Janko Roettgers, “How Hollywood Got Hacked: Studio at Center of Netflix Leak Breaks Silence,” Variety, June 20, 2017, https://variety.com/2017/digital/features/netflix-orange-is-the-new-black-leak-dark-overlord-larson-studios-1202471400/.
11.3.3.2 Bloomberg’s Early Breach
Exposure extortion is nothing new; it is simply that criminals’ tactics have become more sophisticated over time. Many of the lessons from early cases apply today. For example, in 1999, Bloomberg was hit was a cyber extortion attempt. A hacker from Kazakhstan, Oleg Zezev, used a small business to sign up for Bloomberg’s services, which resulted in Bloomberg sending Zezev the software needed to access the company’s systems. Once Zezev had the software, he used it to find vulnerabilities within the system and then gained unauthorized access to employee and customer accounts (including that of founder Michael Bloomberg).
Zezev gathered screenshots of the company’s email inboxes, credit card numbers, and internal data, and then emailed samples of these to Michael Bloomberg. He threatened to disclose the vulnerabilities and theft to the media and Bloomberg’s customers, unless Bloomberg paid him $200,000. “There a lot (sic) of clever but mean heads in the world who will use their chance to destroy your system to the detriment of your worldwide reputation,” wrote Zezev, using the pseudonym “Alex.” He concluded with “Your security and reputation are in your hands.”52
52. U.S. Department of Justice, “US Convicts Kazakhstan Hacker of Breaking into Bloomberg LP’s Computers and Attempting Extortion,” press release, February 26, 2003, https://www.justice.gov/archive/criminal/cybercrime/press-releases/2003/zezevConvict.htm.
Michael Bloomberg agreed to pay $200,000, on the condition that Zezev meet with him in London to explain how he hacked the system. Amazingly, the hacker agreed. After meeting with Bloomberg and his team, Zezev and one of his cohorts were arrested in London. Ultimately, they were extradited to the United States, where Zezev was convicted of extortion and computer intrusion, and sentenced to more than four years in prison.53
53. U.S. Department of Justice, “Kazakhstan Hacker Sentenced to Four Years Prison for Breaking into Bloomberg Systems and Attempting Extortion,” press release, July 1, 2003, https://www.justice.gov/archive/criminal/cybercrime/press-releases/2003/zezevSent.htm.
The Bloomberg case was a rare instance where a cyber extortionist was caught. As in the case of Larson Studios, criminals often pressure their victims not to report to law enforcement in the first place. Even in serious cases where law enforcement agents investigate, extortionists tend to be good at hiding their identities or may be based in nonextradition countries.
James Comey, who at the time was the U.S. attorney for the Southern District of New York, used the Bloomberg hacker conviction as an opportunity to generate positive PR for law enforcement. This was also unusual because cyber extortion is often kept secret. Victims, of course, do not want anyone to know that their systems were vulnerable or that an attacker had access to sensitive information. If the attacker is successful at extorting a payment, often no one finds out. This is especially true for cases where the affected data is not covered by a data breach notification regulation.
Perhaps because law enforcement had successfully captured the perpetrator, the Bloomberg case was publicized. “The Internet is a powerful communication tool in helping international commerce,” Comey said. “This case demonstrates law enforcement’s commitment to prosecute vigorously those individuals, wherever they are located, who seek to abuse this tool to their own ends.”54
54. U.S. Department of Justice, “US Convicts Kazakhstan Hacker.”
11.3.4 Response
The most effective response to exposure extortion is, essentially, to treat it as a data exposure case (see Chapter 10, “Exposure and Weaponization,” for details). After all, once the data is in the hands of a criminal, it’s out there. You never know when it might resurface or become public.
Key actions for response teams to consider include:
Verify that the data is authentic and originated from your organization. As we have seen, in exposure extortion cases, criminals may include information gathered from other breaches as a means of tricking victims into thinking they have more data than they really do.
Proactively communicate with affected stakeholders, such as the data subjects and data owners. This is especially important because the extortionists may reach out to them in order to put pressure on the breached organization to pay. Remember that if you remain quiet and don’t tell affected stakeholders about the breach, you risk damaging trust and potentially place your organization in legal jeopardy. By proactively contacting stake-holders, you preserve more trust in the relationship, and you may have the opportunity to set the narrative if word has not already gotten out. This also gives stakeholders more time to prepare for any potential fallout.
Conduct an effective public relations campaign. This is especially important because extortionists often publicly belittle their victims and attempt to damage their reputations. If the breach is not yet public, prepare a public relations campaign that you can launch immediately if and when it does.
Offer posttrauma counseling for affected stakeholders, such as management, IT staff, and victims. Extortion can be a frightening and emotional experience. In exposure extortion cases, repurcussions often reverbrate throughout the organization and the surrounding community. For many, it is a painful experience that will never be forgotten. In much the same way that organizations hire grief counselors to work with team members after a death, it may be wise to offer third-party counseling services following exposure extortion.
11.4 Faux Extortion
Faux extortion, where the attacker does not actually want what he or she appears to demand, has occurred at a global scale (although it is not as prevalent as denial or exposure extortion).
11.4.1 Case Study: NotPetya
In June 2017, the “NotPetya” malware spread like wildfire. It started in the Ukraine, where employees at organizations across the country suddenly found themselves locked out of their computers, staring at ransom notes that read: “If you see this text, then your files are no longer accessible, because they have been encrypted. . . . We guarantee that you can recover all your files safely and easily. All you need to do is submit payment and purchase the decryption key.”55
55. “NotPetya Technical Analysis—A Triple Threat: File Encryption, MFT Encryption, Credential Theft,” Crowd-Strike (blog), June 27, 2017, https://www.crowdstrike.com/blog/petrwrap-ransomware-technical-analysis-triple-threat-file-encryption-mft-encryption-credential-theft/.
NotPetya used two stolen National Security Agency exploits to infect victims—and it spread like wildfire. “Within hours of its first appearance, the worm raced beyond Ukraine and out to countless machines around the world, from hospitals in Pennsylvania to a chocolate factory in Tasmania,” reported Andy Greenberg of Wired magazine. “It crippled multinational companies including Maersk, pharmaceutical giant Merck, FedEx’s European subsidiary TNT Express, French construction company Saint-Gobain, food producer Mondel ez, and manufacturer Reckitt Benckiser.”56
56. Andy Greenberg, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” Wired, August 22, 2018, https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
But despite the reassurances of the ransom note, no one recovered their files. The malware wasn’t ransomware at all. It was designed to destroy. Security analysts confirmed that the installation ID normally used to recover the decryption key was fake and randomly generated. “Do NOT pay the ransom,” counseled technical analysts from the security firm CrowdStrike. “No files will be recovered if the ransom is paid.”57
57. “NotPetya Technical Analysis.”
After extensive investigation, intelligence agencies concluded that NotPetya was a cyber-weapon developed by the Russian military, designed to damage Ukrainian organizations. The ransom messages were “only a ruse” used to hide the malware’s true purpose.58
58. Greenberg, “Untold Story of NotPetya.”
11.4.2 Response
The appropriate response to faux extortion varies depending on the criminals’ true motives and the impact of the crime. From a data breach management perspective, if there is evidence that criminals may have had access to an organization’s sensitive data, then it should be treated as a potential exposure case.
Requiring proof of data can help responders quickly gauge whether the criminals actually want to negotiate. If the criminals ignore requests or refuse to demonstrate that the data can be decrypted, then responders can ignore demands and quickly move on to a different recovery strategy.
11.5 Conclusion
Cyber extortion has emerged as a dominant threat, fueled by the development of cryptocurrency and point-and-click crimeware. In this chapter, we discussed four different types of cyber extortion: denial, modification, exposure, and faux. In the next chapter, we will discuss how organizations can transfer their risk to insurers and leverage their help during a breach response.