Ryuk ransomware recovery cost us $8.1m and counting, says Baltimore school authority
(2021/06/16)
- Reference: 1623861426
- News link: https://www.theregister.co.uk/2021/06/16/baltimore_ryuk_ransomware_dollars_8_1m_recovery_cost/
- Source link:
An organisation whose network was infected by Ryuk ransomware has spent $8.1m over seven months recovering from it – and that’s still not the end of it, according to US news reports.
The sum, spent by Baltimore County Public Schools, will doubtless raise some eyebrows and the public breakdown of the costs will be eye-opening for the infosec industry and potential corporate ransomware victims alike.
A spreadsheet [1]obtained by Fox 45 News Baltimore, a TV station, revealed the $8.1m spending and also broke it down into individual line items.
NEW:
We're learning more about the price tag of ongoing recovery from the ransomware attack on [2]@BaltCoPS in November.
BCPS provided this line-by-line breakdown of costs -- now totaling more than $8.1 million dollars. [3]@FOXBaltimore [4]pic.twitter.com/07Lp7D4laQ — Amy Simpson (@AmySimpsonTV) [5]June 15, 2021
Of the full sum, $2m alone was spent on “ERP cloud transition and recovery” with provider CGI. A Dell (VMware) Carbon Black cloud-based endpoint security licence for one year of Windows protection came in at $699,298, while $606,648 was spent on device monitoring and tracking.
Just $2m of the $8m spend was covered by insurance, the spreadsheet showed, also noting $11,500 in ransomware negotiation costs. There was no line item explaining whether a ransom was paid or if so, how much it was.
[6]Hospitals cancel outpatient appointments as Irish health service struck by ransomware
[7]Command 'n' control botnet of notorious Emotet Windows ransomware shut down in multinational police raid
[8]Scottish Environment Protection Agency refuses to pay ransomware crooks over 1.2GB of stolen data
[9]Ryuk this for a game of soldiers: Ransomware-flingers actively targeting hospitals in the US, cyber agencies warn
As we reported when it first happened, the BCPS network was [10]infected by Ryuk ransomware in November last year. 115,000 children were unable to access remote classes (being held online due to the pandemic) and were cut off from school for a week while administrators rebuilt critical systems.
The attention of news outlets moved on after a few days (possibly a result of BCPS’ $50,000 spend with FTI Consulting on PR advice), but the enduring tech and financial damage is still being felt months later.
[11]
Infosec firm Sophos said [12]in April that the average cost of getting over a ransomware attack is $2m, a sum that “has more than doubled in a year”. Last year French-headquartered IT outsourcer Sopra Steria [13]said a Ryuk attack was set to cost it between 40 and 50 million euros after “a previously unknown strain” compromised its Active Directory server.
[14]
Ryuk is one of a handful of high-profile ransomware strains being deployed as part of the ransomware-as-a-service market against predominantly Western targets.
Today, US president Joe Biden and Russian president Vladimir Putin are due to meet for the first time; among other topics, Biden will be raising the issue of Russia’s shielding of ransomware gangs from legal consequences for their actions. ®
Get our [15]Tech Resources
[1] https://foxbaltimore.com/news/local/bcps-ransomware-recovery-efforts-come-with-81-million-price-tag
[2] https://twitter.com/BaltCoPS?ref_src=twsrc%5Etfw
[3] https://twitter.com/FOXBaltimore?ref_src=twsrc%5Etfw
[4] https://t.co/07Lp7D4laQ
[5] https://twitter.com/AmySimpsonTV/status/1404887242292838412?ref_src=twsrc%5Etfw
[6] https://www.theregister.com/2021/05/14/ireland_hse_ransomware_hospital_conti_wizardspider/
[7] https://www.theregister.com/2021/01/27/emotet_botnet_taken_down_europol/
[8] https://www.theregister.com/2021/01/18/scottish_environment_protection_agency_refuses_to_pay_ransom/
[9] https://www.theregister.com/2020/10/29/ryuk_ransomware_us_hospitals_warning/
[10] https://www.theregister.com/2020/12/01/baltimore_ransomware_attack/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMp0fz3jrpBObp1s-z7P8QAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[12] https://www.sophos.com/en-us/press-office/press-releases/2021/04/ransomware-recovery-cost-reaches-nearly-dollar-2-million-more-than-doubling-in-a-year.aspx
[13] https://www.theregister.com/2020/11/25/sopra_steria_ransomware_damage_50m_euros/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMp0fz3jrpBObp1s-z7P8QAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
The sum, spent by Baltimore County Public Schools, will doubtless raise some eyebrows and the public breakdown of the costs will be eye-opening for the infosec industry and potential corporate ransomware victims alike.
A spreadsheet [1]obtained by Fox 45 News Baltimore, a TV station, revealed the $8.1m spending and also broke it down into individual line items.
NEW:
We're learning more about the price tag of ongoing recovery from the ransomware attack on [2]@BaltCoPS in November.
BCPS provided this line-by-line breakdown of costs -- now totaling more than $8.1 million dollars. [3]@FOXBaltimore [4]pic.twitter.com/07Lp7D4laQ — Amy Simpson (@AmySimpsonTV) [5]June 15, 2021
Of the full sum, $2m alone was spent on “ERP cloud transition and recovery” with provider CGI. A Dell (VMware) Carbon Black cloud-based endpoint security licence for one year of Windows protection came in at $699,298, while $606,648 was spent on device monitoring and tracking.
Just $2m of the $8m spend was covered by insurance, the spreadsheet showed, also noting $11,500 in ransomware negotiation costs. There was no line item explaining whether a ransom was paid or if so, how much it was.
[6]Hospitals cancel outpatient appointments as Irish health service struck by ransomware
[7]Command 'n' control botnet of notorious Emotet Windows ransomware shut down in multinational police raid
[8]Scottish Environment Protection Agency refuses to pay ransomware crooks over 1.2GB of stolen data
[9]Ryuk this for a game of soldiers: Ransomware-flingers actively targeting hospitals in the US, cyber agencies warn
As we reported when it first happened, the BCPS network was [10]infected by Ryuk ransomware in November last year. 115,000 children were unable to access remote classes (being held online due to the pandemic) and were cut off from school for a week while administrators rebuilt critical systems.
The attention of news outlets moved on after a few days (possibly a result of BCPS’ $50,000 spend with FTI Consulting on PR advice), but the enduring tech and financial damage is still being felt months later.
[11]
Infosec firm Sophos said [12]in April that the average cost of getting over a ransomware attack is $2m, a sum that “has more than doubled in a year”. Last year French-headquartered IT outsourcer Sopra Steria [13]said a Ryuk attack was set to cost it between 40 and 50 million euros after “a previously unknown strain” compromised its Active Directory server.
[14]
Ryuk is one of a handful of high-profile ransomware strains being deployed as part of the ransomware-as-a-service market against predominantly Western targets.
Today, US president Joe Biden and Russian president Vladimir Putin are due to meet for the first time; among other topics, Biden will be raising the issue of Russia’s shielding of ransomware gangs from legal consequences for their actions. ®
Get our [15]Tech Resources
[1] https://foxbaltimore.com/news/local/bcps-ransomware-recovery-efforts-come-with-81-million-price-tag
[2] https://twitter.com/BaltCoPS?ref_src=twsrc%5Etfw
[3] https://twitter.com/FOXBaltimore?ref_src=twsrc%5Etfw
[4] https://t.co/07Lp7D4laQ
[5] https://twitter.com/AmySimpsonTV/status/1404887242292838412?ref_src=twsrc%5Etfw
[6] https://www.theregister.com/2021/05/14/ireland_hse_ransomware_hospital_conti_wizardspider/
[7] https://www.theregister.com/2021/01/27/emotet_botnet_taken_down_europol/
[8] https://www.theregister.com/2021/01/18/scottish_environment_protection_agency_refuses_to_pay_ransom/
[9] https://www.theregister.com/2020/10/29/ryuk_ransomware_us_hospitals_warning/
[10] https://www.theregister.com/2020/12/01/baltimore_ransomware_attack/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMp0fz3jrpBObp1s-z7P8QAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[12] https://www.sophos.com/en-us/press-office/press-releases/2021/04/ransomware-recovery-cost-reaches-nearly-dollar-2-million-more-than-doubling-in-a-year.aspx
[13] https://www.theregister.com/2020/11/25/sopra_steria_ransomware_damage_50m_euros/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMp0fz3jrpBObp1s-z7P8QAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Re: Erm
SGJ
Almost certainly the only way IT could persuade the Pointy-haired Bosses to spend the money. Give it a few years and new financial pressures and the budget will be cut again!
Anonymous Coward
Wow! Their initial recovery costs add up exactly to the limit on their insurance policy! How crazy is that! Like, if I had a fire and my house was insured for 2 million pounds, and it just so happens that every item and work of art I had at the time adds up to exactly that amount :D
Erm
So they're claiming that all work to prevent future attacks is the result of this one attack, rather than what they should have been doing anyway?