Cyber extortionists intensify attacks on small Indian firms

According to a report published by security firm NordLocker on Tuesday, small businesses (with up to 500 employees) comprised 54% of ransomware attacks in the country between January 2020 and July 2022.

Cyber extortionists, often referred to as ransomware gangs, break into a company’s network and block access to crucial and sensitive files, and demand ransom to return the access. The company and its employees are blocked from accessing any of the files till the ransom is paid, resulting in business disruption and financial loss. Many of these gangs are now offering ransomware-as-a-service (RaaS) leading to proliferation of such attacks.

A security researcher working with a leading consulting firm said such gangs run like any other businesses. They have multiple departments like HR, finance, administrators, coders and researchers. They even have policies on how the hackers should process their code, and share best practices to keep the group’s members hidden. For instance, last December, a small town book publisher from West Bengal was hit with one such attack. The firm’s chief executive, who requested anonymity, said they have been paying the ransom in instalments for eight months but have still not been able to gain access to all the files.

An October 2021 report from Gartner had warned that on an average, only 65% of data is recovered from such attacks, and only 8% of organizations recover all of their data. Similarly, the IT head of a healthcare solution provider that runs a chain of diagnostic centres across eastern India, said its customer database was destroyed in an attack during the peak of the pandemic. The company informed the CERT-In, but had to rework its entire database and software before resuming regular operations. [email protected]