Ransomware
Ransomware
What is ransomware?
- Encrypts files and demands payment
- Devastating for businesses
- Backups and training are the best defense
The essence of a ransomware incident is not that data disappears but that time disappears. When the production management system locks up, the line stops; when the ERP locks up, tax invoice issuance and payroll slip; and shipment delays come straight back as complaints from customers. So the question executives must answer first is not “did they get in?” but “how many days until we can run again?” Unless you set the recovery time objective (RTO) and the tolerable data-loss window (RPO) as numbers in advance, all you can do in the boardroom on the day of the incident is vote on whether to pay the ransom.
Today's attacks don't stop at locking files. Double extortion is now commonplace: before encryption, attackers steal design drawings, customer data and contracts, then threaten to publish them unless the victim pays. Some even contact business partners and the press directly to raise the pressure. Because ransomware-as-a-service (RaaS) lets criminals rent out attack tools and share the profits, even people with no technical skill take part. There is one line to draw here. If your files were only encrypted, it is a recovery problem. But the moment data leaves your network, it becomes a legal incident, with both a duty to report the personal data breach and an obligation to notify your business partners.
Preparedness depends not on whether you have a backup but on the backup’s connection status. A NAS that stays attached to the production network gets encrypted along with the server, so the 3-2-1 rule (3 copies, 2 media types, 1 copy off-site) and immutable storage that cannot be overwritten are the baseline. Multi-factor authentication for admin accounts and blocking remote access ports belong in the same package. Still, if you haven’t run an actual recovery test once a quarter to measure how many hours it takes to get business screens back up, it is hard to say you really have a backup.
The first response is where things most often go wrong in practice. If you panic and format or reboot an infected PC, the entry point and its traces are wiped out too, and you get hit again through the same door without knowing where the breach was. Believing that paying the ransom ends the problem is just as dangerous. The recovery tool the attacker provides often works poorly and restores only some of the files, data that has already leaked cannot be retrieved, and your reporting obligations do not go away. Cyber insurance only covers losses after the fact; it cannot bring a halted production line back. Your negotiating leverage ultimately comes from last night's backup.
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal branding
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ sessions, making AI usable even for non-specialistsEarly cases appeared in the late 1980s; with the spread of cryptocurrency, they surged in the 2010s and became a global threat.
Consider a hypothetical case. Company A, an auto-parts maker with 210 employees and KRW 74 billion (≈ US$55,364,400) in annual revenue, had its manufacturing execution system (MES) server and file server locked at the same time at 11 p.m. on a Friday. Its first shipment on Monday, worth KRW 300 (≈ US$1) million, was at stake. Worse, the backup NAS was plugged into the same switch, so it had been encrypted too.
- At 1 a.m. on a Saturday, the production manager called to say, "The shop-floor PCs are showing nothing but a Notepad window with English text," and the head of the IT systems team immediately unplugged 12 factory network switches to stop the spread.
- Everyone said to reformat, but the head of the IT systems team said "If we wipe them now, we’ll never find the entry path" and sealed off the 4 infected PCs. Working through the logs with an outside security firm, they confirmed that a partner company’s VPN account had been breached.
- At an emergency meeting on Saturday morning, the CEO chose recovery over paying the ransom. The MES was restored from a backup made on external tape three months earlier, and the three weeks of inventory data in between were filled in by manual reconciliation.
- For the five days the ERP was down, the finance team managed 1,200 tax invoices temporarily in Excel, and the head of sales phoned 38 clients directly to tell them up front, "Delivery will slip by two days, but we will still deliver the full quantities."
- Afterward, the company disconnected backups from the production network, moved them to immutable storage, and cleaned up 31 of its 47 partner VPN accounts. In a recovery drill six months later, MES restart time fell from 5 days at the time of the incident to 4 hours.