Imagine this: you’ve just built a state-of-the-art system for your business to store all of its records and customer data. It’s working seamlessly and allowing your team to run efficiently, while seemingly keeping all of your information secure.
Then — it disappears. Hackers contact you and demand that you pay a ransom you can’t afford to get your data back. You don’t have that amount of money, and don’t have any guarantee that they’ll actually follow through with their promise even if you do pay. But your business cannot function without that data. What do you do?
This is the situation that A1Care CEO Percy Syddall found himself in several years back. And it’s become all too common for other businesses as well.
As a home health care company in California, A1Care’s situation was especially sensitive due to the fact that patient records and health information had been compromised. While every ransomware attack presents unique challenges to businesses, this one illustrates many of the concerns that accompany such a situation.
Since then, Syddall and his team have taken great care to enhance their cybersecurity efforts and hopefully prevent a similar situation from ever impacting A1Care in the same way. Here are some tips and insights to consider if your business ever has to deal with a ransomware attack, or if you want to prevent one from happening in the first place.
What to Do If Ransomware Attacks Your Small Business
Evaluate the Threat
Every ransomware attack is different, so there isn’t one right way to handle the situation. Most experts advise against paying ransoms, as there’s still no guarantee that you’ll get your data back. In some cases, like screen-locking ransomware, you may be able to find a professional who can get around it and unlock your system.
Get Authorities Involved
At the time of A1Care’s attack, ransomware was a relatively unknown concept. However, today the FBI has an Internet Crime Complaint Center that’s specifically set up so that you can report online crimes like ransomware attacks. You’ll want to photograph the ransom notification and any other communication from the attacker to include with your report.
Alert Your Customers
Syddall says that the hardest part about dealing with the attack was having to tell each of his customers that their personal data had been compromised. It’s certainly not an activity that any business owner looks forward to. But your customers need to know if an attacker or anyone outside your organization has gained access to any confidential information you’ve given them.
Find New Solutions
At the time of the attack, A1Care’s system was protected by two major anti-virus software programs. Those programs performed weekly scans to detect threats. But Syddall believes that attack happened overnight, and thus went undetected.
After the attack, he began searching for something that would provide a higher level of protection. In addition to basic protection practices, the company now utilizes BoldCloud, a security solution that essentially adds an insurance policy to your data in case your system is compromised and backups fail.
Ask the Right Questions
Syddall says, “I always ask people when they pitch me these solutions, ‘Am I hackable?’ If they say, ‘No, not with this solution,’ then I know they’re just trying to sell me something and not really being honest about what they offer.”
Continue to Look Out for New Solutions
Syddall adds, “Even though we’re very happy with BoldCloud, I’m always open to new solutions and adding to our current protections. You never know when a new type of threat is going to pop up and what new tools might be out there to help you fight it.”
Marcus Chung, CEO and co-founder of BoldCloud agrees that adapting to new situations is important. “Small businesses face special and unique challenges daily. Most have limited resources, cybersecurity expertise and most importantly, ‘limited time’! The vast majority of today’s threats attack broadly and do not discriminate whether your business is a Fortune 500, Forbes 1000 business or not. Every business needs to be vigilant, prepare to adapt your security with a layered approach, be proactive and then stay safe.”
Back Up Important Files
Syddall says that his company was lucky because they did keep hard copies of customer contracts that they could refer to during the attack. However, they didn’t have backups of anything else, which made operating during that time a major challenge. Now, they keep hard copies of other important documents as well, just enough so that they can continue operations in the event of an attack. If you prefer not to keep physical files, at least make sure your data is backed up in another system or location that you can access if your main one is attacked.
Monitor Employee Activity
There are certain types of sites or links that are more likely to lead to a member of your team inadvertently exposing your system to ransomware. To limit those threats, consider implementing training sessions, blocking high risk sites or monitoring employee use so you can speak with those who expose your system to threats by visiting those high risk sites.
Always Put Customer Relationships First
After this situation was resolved, Syddall continued to make customer communication a major part of his business. He continues to reach out to clients to make sure their data hasn’t been used or compromised any further and ensures people that they’re being vigilant to avoid future attacks.
Photo via Shutterstock