Boutique hotel suffers ransomware attack
Introduction
What happened
The attackers exfiltrated the data and sent a message to the hotel management threatening to release it on the darknet if a payment of USD 500.000 in Bitcoin was not sent within 48 hours.
Immediate effects
The hotel management was unfamiliar with ransomware attacks and tried to get support from their IT team. After several hours of failed attempts to restore system health, the hotel management contacted a cyber incident response firm.
Unfortunately, precious time was lost in searching for a suitable contractor and during onboarding, causing a considerable amount of time to be lost and more data to be leaked. This could have been avoided if the hotel had purchased a retainer like Blackpanda’s IR-1.
Impact
The first priority of the incident response team was to carry out containment and eradication actions, to ensure that the threat actor did not carry out further damage to the network.
Digital forensics experts were brought in, and they confirmed that data exfiltration had taken place. They also assessed that personally identifiable information (PII), including guests’ full names, dates of birth, passport numbers, and credit card details was stolen.
The hotel also had to engage external security consultants to resolve their server patching issues and secure their environment following the breach.
Given that PII was exfiltrated, the hotel was obliged to notify all affected individuals of the data breach. The hotel engaged a legal and a PR firm to support them around mandatory notification.
The hotel also decided to extend commercial vouchers to its affected clients as a reputational damage mitigation measure.
The hotel chose not to pay the ransom, and to work hard on restoring their security and paying reparations to the affected guests.
The data breach resulted in significant financial losses for the hotel. The following are the breakdown of the costs incurred by the hotel:
- Incident Response team costs: USD 60 thousand
- External IT consultants for implementation of security recommendations: USD 35 thousand
- Notification costs: Legal firm and PR firms fees USD 115 thousand
- Commercial gesture to clients: USD 45 thousand
Potential implications
Critical operations were disrupted as the attackers’ encryption locked down crucial systems, paralysing day-to-day activities. The hotel’s ability to provide seamless guest services was severely compromised, resulting in disrupted reservations, cancellations, and a loss of customer confidence.
Moreover, the attack dealt a significant blow to the hotel’s reputation. Guests expressed concern over the security of their personal information, raising questions about the hotel’s commitment to data protection and privacy.
How to avoid this?
The data breach highlights the importance of having a robust cyber incident response plan, as this would have saved the hotel precious time in handling the breach. Cyber attacks can have devastating effects on a business’s reputation and financial stability.
Waiting for an attack to happen before you contact a cyber incident response team can cost precious time and a high hourly fee.
A big part of avoiding large costs related to a cyber crisis is to proactively prepare for a cyber incident, as businesses of all sizes are a potential target. Blackpanda’s IR-1 subscription is a predictable, accountable, and highly cost-effective solution for small and medium organisations in Asia, to prevent surprise high costs from cyber attacks.
Blackpanda’s IR-1 subscription is the most cost effective solution for small to medium sized organisations in Asia Pacific facing limited resources and knowledge in managing cyber attacks.
With IR-1, Blackpanda helps organisations manage cyber attacks and mitigate their impact by offering a 12-month subscription plan priced at less than 10% of what a typical cyber incident response case charged by the hour would be.
IR-1 includes 24/7 incident response availability, one incident response activation credit, proactive risk advisory, discounted rates for Blackpanda services, and unlimited access to a digital library containing guides to improve your organisation’s cyber security posture, news and awareness materials. IR-1 is staffed by highly trained specialists, and businesses can renew the subscription upon expiry.
