ARRL IT Security Incident – $1M ransom

https://www.arrl.org/news/arrl-it-security-incident-report-to-members

by 7402 • 2 years ago

45 21 2 years ago

jrexilius2• 2 years ago

Why did they agree to pay the ransom? Such a small org it seems like they could rebuild the systems they needed for less than $1mil?..

loandbehold2• 2 years ago

Their insurance covered ransom. Why on the earth does insurance cover ransom? Doesn't it encourage such attacks? Ideally paying ransom should be illegal as it just funds further attacks.

selectodude• 2 years ago

Insurance companies will see if it was a novel targeted hack that really couldn’t have been stopped vs laziness and poor security hygiene in which case they will cover less.

II2II• 2 years ago

Would it stop ransomware attacks, or is it another one of those situations where the cost of launching an attack is so low that you only need an insignificant number of desperate victims to pay in order to profit?

I am also left to wonder if paying helps the investigation.

BobbyTables2• 2 years ago

Why wouldn’t an insurance company want to keep 20% of premiums covering ransom payments ?

They stand to loose future premiums if paying ransoms is NOT broadly seen as a viable option.

Sure, in the short term, they hate customers that make a lot of claims. But those claims, in aggregate, are the fuel for their 20% skimming…

If nobody paid ransom, why would they want insurance coverage? And if no insurance covered it, they wouldn’t be able to skim off the corresponding premiums…

jrexilius2• 2 years ago

You are touching on my thoughts exactly. It seems everyone would come out better if the insurance company just paid for them to rebuild. I suspect that'd come out cheaper and it would maybe deter the attacks by making them worth less..

firesteelrain• 2 years ago

It’s light on details but perhaps there was data that was not easy to recover.

We also have to consider the rebuild labor and if entire systems are corrupted then repurchasing new systems.

rexreed• 2 years ago

That's also my question. In general, can someone explain why offsite, offline, multi-timescale backups don't help in these cases?

Yes I get that insurance paid the extortion, but besides just capitulating, why doesn't restoring from backup work, assuming you can spot the vulnerability that caused the ransomware attack?

batch12• 2 years ago

The only way to make ransomware go away is to make the penalties for paying higher than the ransom.

smegsicle• 2 years ago

decimate the it security team

SnorkelTan• 2 years ago

or the liability for the fault with the software maker. Like a defective car that kills ppl reners the manufacturer of the car responsible.

Eduard• 2 years ago

amateur radio lives in a different IT world. A significant amount of popular software is shared as archived source files with ambiguous licensing, hosted on personal homepages, and served via unencrypted HTTP.

ronsor• 2 years ago

You're lucky if you get source files.

rincebrain• 2 years ago

It lives in the late 80s, if you're lucky, and earlier than that if you're not.

gustavus• 2 years ago

Sometime in early May 2024, ARRL’s systems network was compromised by threat actors (TAs) using information they had purchased on the dark web. The TAs accessed headquarters on-site systems and most cloud-based systems

So someone was using the same password for the work and personal stuff and no one has ever bothered prioritizing 2FA got it.

SoftTalker• 2 years ago

Good excuse to start over.

I lost a hard drive once due to a failure. It was actually liberating. A lot of old stuff I didn't have to worry about anymore.

underlogic• 2 years ago

probably some kids in a basement. most security admins I've met are total frauds. sophisticated for $1m? no they're just trying to keep their jobs after being revealed as totally incompetent.

hi-v-rocknroll• 2 years ago

The failed at having backups and DR/BCP.

Also, paying ransomware demands should have civil and criminal penalties because all it does is cause more of it. Ransomware insurance should also be illegal.

tonymet• 2 years ago

the threat actors also compromised the cloud accounts. it's likely the backups were also captured

fortran77• 2 years ago

They should have just rebuilt it. (I've been an ARRL member since 1977). I suppose they didn't want to lose LOTW.

ARRL IT Security Incident – $1M ransom

Related Stories