Much has changed since the high-profile ‘Wannacry’ ransomware cyber attack of 2017, which locked a third of NHS trusts out of their devices, forced the cancellation of 19,000 medical appointments, all at a total cost of £92m to the British taxpayer.

Wannacry infected up to 200,000 computers across more than 150 countries worldwide, by targeting unsupported and unpatched networks running the Microsoft Windows XP operating system.

Nearly a decade on, ransomware attacks are more polished, and often offered as part of ‘crime as a service’ packages. In mid-August, a ransomware attack against online banking platform Revolut, resulted in the theft of thousands of customers’ data.

IBM’s latest X-Force Threat Intelligence Index says the number of ransomware operators has almost doubled (49%) compared to a year ago. According to research by Verizon, nearly half of all cyber attacks (48%) involve ransomware-led breaches. And, as low barriers to entry and AI augmentation drive demand, the crime itself is evolving into something far more damaging.

Phil Osgathorpe, director and head of Cyber and IT Assurance at PFK Francis Clark chartered accountants, tells the story of a company targeted with what, at surface level, looked like just a ransomware attack but acted almost like a ‘Trojan horse’, masking a different, concurrent cyber breach altogether.

“On the face of it, it looked like a ransomware hack, when what was actually happening underneath were more subtle behaviours of installation or monitoring of other things on their network, systems and devices, all going on under the radar,” he says.

To pay, or not to pay?

Last year the government announced plans to ban public sector and critical infrastructure organisations from paying ransoms, making them less attractive to hackers if no post-attack booty is forthcoming. For private sector corporations, it’s less clear-cut.

Tristan Hodgson, Director of Cyber Risk Services at Mitigo Group notes that paying ransom is not illegal in the UK, but highly discouraged, as it never guarantees network or data restoration. Large firms may have "ransom budgets" in their crisis plans, whereas SMEs often lack the financial resilience, “making an attack potentially existential”, he says.

Smaller organisations may assume that they can recoup ransom payments through their cyber insurance policy. However, not all policies cover these payments, and many providers are limiting coverage due to the high cost of ransoms.

How to respond

Regardless of whether your company intends to pay up or not, there are a number of ‘non-negotiable’ actions you can take in response to a ransomware attack: having a pre-arranged incident response plan is paramount.

Shockingly, given the rising frequency of cyberattacks, a mere 25% of UK businesses and 19% of charities actually have a plan in place: of those, a significant proportion have never tested or rehearsed those plans, meaning that firms often foster a false sense of security about how prepared they actually are.

The First Hour: the critical response period after the attack, when an ideally rehearsed, pre-arranged, incident response plan is rolled out, co-ordinated and executed by your crisis management team where every member is aware of their designated role.

But, without the benefit of an incident response plan, the advice from Hodgson first and foremost, is that you ‘gather the team’ to get you through the aftermath:

• make all senior internal stakeholders aware of the breach immediately, whether or not their domains are directly impacted;
• inform your insurers;
• contact your IT desk or managed service provider to isolate or shut down the compromised network and establish alternative communication routes in the short term; and
• engage external experts to advise on the non-technical ramifications of an attack.

“If you haven’t planned for this, you’re not going to be able to do this yourself,” Hodgson says.“ Aside from the technical issue with the breach, you’re getting into compliance, data regulations and legislation. There’s a very good chance that your managed services providers (MSPs) aren’t the ones to lead you through it.”

The cost of the actual attack isn’t the whole story either: failure to comply with Information Commissioner’s Office regulations around disclosure and proper personal data preservation may result in a fine or other sanctions. And of course, customers can also take legal action.

What steps to take

Gather evidence

Once the team is in place, ensure that every decision in the salvaging process is logged or recorded. This information will serve as critical evidence of the attack when needed later and help evaluate a response to current and future attacks.

Know who’s in charge

In the heightened state of that first hour, “it’s easy to confuse activity with control”, Luke Blake, co-founder and crisis management expert at Oakwood Risk Group, says. “You need somebody coordinating the incident, establishing facts and making deliberate decisions, rather than ten different teams doing ten different things, trying to fix things independently.”

Inform stakeholders 

Transparency is key, says Blake, but must be balanced between what’s best for the company and what should be disclosed to retain trust with stakeholders. “Be very clear on what you know, and do not speculate about what you don’t know.”

As a crisis management expert, Blake emphasises the need to develop the workforce into a constant line of defence, as opposed to the driver of the attacks themselves.

“Because of AI’s involvement, there’s going to be a point at which attacks become more frequent and more complex, and trying to keep playing catch up is going to be difficult,” he concedes. “If we develop people to have this capacity to be flexible and adaptive to deal with issues and incidents, then they can deal with them, regardless of whether it’s a cyber attack or a critical supplier failure.”

The National Cyber Security Centre (NCSC) has further guidance on how to prepare and respond to a ransomware attack.