Irish Times reports Irish firm hit by infected ad, then ransom demand

What happened

The Irish Times reports that a small business owner, identified only as Sarah, says her company was hit by a cyberattack after she returned from a lunch break. She told the paper that files on her computer disappeared one by one and that shutting the machine down was too late. The Irish Times

According to the same article, the attack was “later traced to an infected ad on a website”. The report does not say who traced it, and it does not name the website or the ad network. The business reportedly lost sight of which invoices had been sent and which were due, and its planned work schedules were wiped. The Irish Times says a ransom demand followed, payable in bitcoin. The Irish Times

The Irish Times reports that the company had no in-house IT staff and eventually found a security expert willing to help. According to the article, the company paid the ransom, the files were returned quickly once the hackers were paid, and restoring everything took a weekend. The Irish Times

Not confirmed: the company’s real name, the website and ad network involved, the malware or ransomware family, the attacker, and the ransom amount. All of this rests on one anonymised account relayed by one outlet. There is no independent verification and no official advisory.

The article also gives wider context, all attributed to the people it quotes:

• It cites data from insurance broker Gallagher and the Centre for Economics and Business Research, published in July, which found as many as two-thirds of Irish businesses were hit by at least one cyberattack in the past year.
• Security consultant Brian Honan says targeted attacks are rare and that companies are often victims of a bigger attack aimed at a weakness in software.
• Stephen O’Keeffe of PwC says attackers increasingly target digital identities and credentials, and that ransomware now often includes a data theft component.
• The article also describes a separate cyberattack on SuperValu that it says affected refrigeration units in 13 stores. That incident is not linked in the article to the infected-ad case.

The Irish Times

Am I affected?

The source does not give enough detail to say. It names no website, ad network, software, version or indicator of compromise, and no CVE is cited. Not confirmed: whether any specific site or ad network is involved, and whether the incident was ransomware in the technical sense.

The report is most relevant to small organisations that browse the web from workstations holding business files and have no dedicated IT or security staff. That is a reading of the account, not a finding by the source.

What to do now

1. Treat this as a single reported case, not a confirmed campaign. Do not act on any indicator attributed to it, because none is published.
2. Decide in advance who you would contact during an incident, such as an outside security provider, since the business in the report says it struggled to find help. The article does not say this is a sourced best practice.
3. Check that you keep backups and that you can restore from them. The article does not state whether the business had backups, so this step is our suggestion and not a sourced finding.
4. Prepare to respond quickly and communicate clearly with stakeholders. This is the approach Brian Honan describes in the article. The Irish Times
5. Follow updates from the original outlet. If the site, ad network or malware is named later, this advisory will be updated.

Sources

• The Irish Times: Cyberattacks : I could see all my files on my computer going one by one