Cybercrime can have an infinitely greater impact on a worker's daily life than one might expect. 300 employees of an American marketing company, Heritage Company, based in Arkansas and brought to its knees by a ransomware attack, learned this the hard way. Ransomware is a type of malware that restricts access to the device it infects, demanding a ransom to be paid to remove the restriction.
But let's take it step by step: it is October 2019, and the company's servers are hit by malicious software that encrypts accounting data and documents. The company decides to pay the ransom and try to return to normal as quickly as possible, all while most of its employees are kept in the dark about the attack.
Once the key is received, the IT department begins data recovery, which however takes longer than expected. Business activities come to a halt
And as time goes by, Christmas approaches. Since it is impossible to issue invoices and record payments received, the CEO, Sandra Franecke, decides to use personal funds to buy the year-end bonuses for employees.
When the IT team postpones the completion of data recovery yet again, the situation becomes untenable, and it becomes necessary to tell all employees what happened and temporarily suspend operations.
300 employees are temporarily laid off, waiting to find out whether the company will manage to recover all the data needed to resume operations and how it can overcome the crisis, which has by now cost the company hundreds of thousands of dollars.
LESSONS FROM THE HERITAGE COMPANY CASE
A few takeaways from this story:
The “Heritage case” shows that many companies do not invest enough resources and energy to prevent the most disastrous effects of potential cyberattacks. Very often, even medium-to-large organizations underestimate expected losses and overestimate the costs of cybersecurity investments.
The ability to prevent or withstand cyberattacks will increasingly become not only a survival factor for organizations of every size but also, and above all, a competitive advantage in the short, medium and long term.
Finally, it should be noted that the lack of transparency when handling a data breach is among the worst practices possible. Burying one's head in the sand often worsens, frequently irreparably, relationships with all stakeholders (customers, employees, public authorities), enormously increasing reputational damage.