A lot of people wake up to a headache on New Year’s Day, but Travelex CEO Tony D’Souza woke up to a nightmare. On New Year’s Eve, the foreign currency supplier became the latest large business to fall victim to a ransomware attack.
The company, which supplies money to a number of high street banks including Lloyds, Barclays and RBS, was forced to shut down its computer system entirely. Cashiers had to resort to pen and paper to log existing orders. Online customers found themselves in limbo, unable to pick up the money they had ordered but unable to claim a refund either.
The attack was the latest in a worrying spate of ransomware attacks, in which attackers lock a company out of its own computer system and then demand money to restore it. This is often coupled with data theft and the threat of selling or sharing sensitive information if the ransom is not paid. Kidnappers don’t send fingers through the post anymore. They leak phone numbers on Russian forums instead.
Aside from the disruption to the business, the attack has been a PR disaster for Travelex. Staff have criticised the company’s handling of the situation, saying that they were given little information about the attack and the subsequent efforts to contain it. If it turns out that confidential client information was stolen, Travelex could face harsh penalties under GDPR law, not to mention irreversible damage to the brand’s reputation.
Although Travelex has refused to comment on whether it paid the $6 million ransom demanded by the attackers, a gradual return to normal functionality has led many to speculate that it did. If this turns out to be the case, the PR fallout could be even worse. All in all, not a great start to 2020 for Mr D’Souza.
How was the attack carried out?
The exact details of the breach remain unclear, but such attacks show no sign of letting up. Highly trained gangs are using ever more sophisticated methods to exploit weaknesses in corporate security. Techniques such as phishing or spear-phishing, in which staff are tricked into sharing confidential information in response to fraudulent emails, are becoming increasingly common. Bespoke viruses, which can bypass antivirus software in order to target a particular set of information, are also an emerging hazard.
How can you protect yourself?
While no one can offer you 100% protection, there’s no need to feel powerless in the face of so much danger. There are several precautions that you can take to reduce the risk of an attack. Staff training is vital. Your employees must be able to spot phishing emails before they part with sensitive information. A good place to start is our free phishing test, which will tell you how prone you are to email scams.
It is also important to keep all of your software up to date. Updates aren’t just there to annoy you. They are usually released in response to an emerging vulnerability. When the update message pops up, click “Yes”, put the kettle on, and let your computer do its thing. It might be worth putting some time aside every month for the whole team to update their software. If nothing else, it gives you a chance to catch up with your colleagues while the computers are off!
These steps are a good start, but they won’t protect you from more sophisticated threats. For more advanced security techniques, take a look at our guide to multi-layered IT security.
Call the experts
When it comes to cybersecurity, it’s always better to be safe than sorry. There are so many ways you could fall victim to a cyberattack, and as the Travelex case shows, so many ways it could impact you. It can be hard to spot security weaknesses from the inside, so it pays to bring in a fresh pair of eyes.
At Nebula, we can provide a complete review of your cybersecurity, as well as expert advice on how to patch up any gaps in your defences. Call us today on 01454 534 009 to arrange a personalised consultation.
