Trigona Ransomware

The Trigona ransomware entered your system by:

• Exploiting vulnerabilities

• Leveraging valid accounts

• Scoping network weaknesses

We recommend you adopt policies to:

1. Educate your staff on the importance of cyber security and the risks of not complying

2. Use strong passwords

3. Multi-factor authentication

4. Remove old users

5. Perform regular backups

6. Deploy timely updates to software and systems

After recovering from a Trigona ransom attack, Zensec recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

Most ransomware breaches cost approx. £500K with smaller email data breaches in the realm of £50K. There is a dichotomy of preserving the environment for forensics or recovering it quickly for less business interruption. The cost increases the longer it takes to identify the breach and resolve it.

A cyber security insurance claim is complex and includes reasonable expenses to investigate and remediate an incident along with cover for legal, business interruption, criminal liability, employment liability and ransom policies. The insurance industry is liable to deliver the business recovery BUT Cyber insurance is viewed as volatile within the industry and many insurance policies are not being validated correctly.

Navigating through this requires expertise, which is where Zensec can help.

Most likely, yes. Some of the lost data might be classified as "Personal Data" for your customers which you are legally obligated to protect. As a ransom attack means this data may have been lost, you hold a legal and moral duty to inform your customers. You also need to inform the Information Commissioner's Office (ICO) at https://ico.org.uk/.

Thankfully your insurer or legal counsel will be able to guide you on what steps to take and how to proceed. Alternatively, Zensec has expertise in collaborating with insurers and lawyers and can aid in handling this relationship during this challenging period.