Pennsylvania Senate Democrats Paid over $700,000 to Rebuild IT Infrastructure after a Ransomware Attack

Microsoft has been paid $703,697 by the Pennsylvania Senate Democratic Caucus to rebuild their IT infrastructure after getting targeted by a ransomware attack in March 2017.

The incident happened on 3rd March, 2017, when the entire IT systems, which includes web servers, of the organization went down to an unrevealed ransomware strain. The files were encrypted by the ransomware, and then the attackers demanded that 28 bitcoins has to be paid for decryption key, which will unlock the data.

The worth of ransom demand was around $30,000, on the basis of Bitcoin to US$ exchange rate during that time. However, the officials decided not to pay, and instead opted to restore some data from the backups and also rebuild the entire IT systems again from scratch. This decision has cost them $700,000 invoice from the Microsoft, as per the information obtained through Right-to-Know request by TribLive local reporters as posted on September 24, 2018, by zdnet.com.

Pennsylvania Senate Democrats are not alone who have decided not to pay the ransom demand, and instead opted for rebuilding the entire IT systems again. Last year, the trend was followed by many ransomware victims.

Atlanta city became victim to a similar attack in March this year, when SamSam ransomware infected many city government's computers. The initial cost for IT rebuilding was estimated at $2.6 Million, which very soon increase to $9.5 Million, whereas now final bill is expected to be around $17 Million.

The reasons why many organizations have choose rebuilding their IT systems is because no matter whether they pay the ransom or not for recovering the data, they have to rebuild it for avoiding future headaches.

A few of the ransomware infections were work of the organized cybercrime groups, who don't have to depend on spam email for infecting organizations through careless employees, but work on the weak points in IT infrastructure, like insufficiently protected endpoints of RDP, Java-based web apps, etc. These are targeted attacks which can be repeatedly exploited, until proper fixes were deployed by the system administrators. Thus, a few organizations just choose rebuilding to avoid future tensions, which is a good idea although costly in short term.

» SPAMfighter News - 9/28/2018