Ryan Cropper, owner of Able Body Shop, a three-store operation in Anchorage, Alaska, nearly lost everything on his personal office computer. By chance, he had come into his office on a Saturday morning to catch up on some work. He turned on his computer and noticed that all the icons he was used to seeing now looked like little gift boxes with books in them. It was a gift all right – a really bad one. When he clicked on one of the boxes, instructions appeared on what he needed to do if he ever wanted to use his computer or see his files again. Cropper’s computer had been attacked…and access to it and all his data associated with it were now being held for a $4,000 ransom. No negotiation. Take it or leave it. What a nightmare!
Cropper immediately contacted his IT guy, who logged into Cropper’s system remotely and saw what happened. He did some research and found out that the person who was demanding the ransom was a professional hacker from Russia who makes good money doing what he does. He demanded $4,000 in bitcoin, which is cyber currency that can’t be tracked. This hacker was scanning local companies looking for any open ports he could hack into. In Cropper’s case, the hacker found an open port that Cropper uses to gain remote access to his computer when he travels. That’s all it took. Now, what to do…
Business As Usual?
Cropper considered what it would take to simply shut everything down and start over. He considered the hours and hours it would take to recreate everything. Thankfully, none of the data was employee data or customer’s personal data. He had his data backed up (which we should all do), but starting over with software installation and setup, email system setup, etc., was just too big and expensive to contemplate. So $4,000 seemed like the “easier” way out, even though it would be financially painful. He paid the ransom, not really knowing if he would ever get things back together or not. There was no way to know for sure. He waited. And waited. Finally, three days later, he received an email with a password that would get him back into his system. It worked, and he was back to business as usual. Well, not really “as usual”…
Nope, if you end up being a victim of a cyber attack like this, you’ll never conduct business as usual again. It changes you. In Cropper’s case, he was fortunate enough to have insurance, including cyber liability/social engineering coverage, which covered his loss minus a $500 deductible. Then, he beefed up his online security and set up multiple layers of highly encrypted passwords.
Protecting Yourself
How do you protect yourself? You don’t really need to be an expert in any of this, you just need to know the steps to take to help block these attacks as best you can. Firewalls, closing open ports (with IT staff support), Norton or other top-shelf software and employee policies with enforcement all help. David Willett, the automotive industry general manager at Intrepid Direct Insurance, assisted me in researching this topic and shared that Intrepid has an insurance plan available that includes a special browsing tool, a sample “security awareness and training” policy for staff and online staff training to help educate and defend against malicious ransomware attacks. You need a network and data security policy in place – and regularly update it – for your employees. A sample copy can also be found on my website here.
Summary
Because there is way too much to cover here in the space I have for this column, I’ve created a one-hour workshop on cyber security that is approved for AMI credit. It covers real-life examples such as the one Cropper went through and steps you can take to protect yourself. It also includes information on the kind of insurance you should have to cover any losses you might suffer. You can access this online workshop here.
There are many steps you can take to make it harder for hackers to hit you, but nothing is impenetrable. Hackers usually don’t waste much time when they hit walls. They just move on until they can find an easy way in somewhere else. But, just in case, you should have some insurance in place to protect you financially. You don’t want to lose it all. Just ask Ryan Cropper.
BodyShop Business Contributing Editor Mark Claypool has more than 30 years of experience in the fields of workforce development, apprenticeships, marketing and web presence management with SkillsUSA, the I-CAR Education Foundation, Mentors at Work, VeriFacts Automotive and the NABC. He is the CEO of Optima Automotive (www.optimaautomotive.com), which provides website design, SEO services and social media management services.
