Introduction

Casual, honest, and a bit humorous – that’s how we roll here. Our audience? Anyone who’s curious about the chaos and comedy that comes with defending businesses from cyber attacks.

So, what brings us here this time? Recently, the news was buzzing about a mid-sized company hit by a so-called “cyber attack.” They had to send customers home and shut down, but if you’re picturing flashing screens demanding Bitcoin and skull-and-crossbones, not this time. There are different flavors of cyber attacks, and we’re going to break ’em down, sharing some stories and lessons along the way.

---

Ransomware Explained

Let’s get down to basics. You open the office in the morning and every screen says, “Send us Bitcoin. We’ll unlock your stuff.” Not exactly how you want to start your day, right?

But ransomware isn’t just about those flashy, ransom-demanding screens. There are other ways attackers mess with companies, like stealing data and selling it on the dark web, or quietly extorting money without anyone really noticing until it’s way too late.

Types of Cyber Attacks

• Classic Ransomware: This is the big one. Your files get encrypted. The attackers demand payment (usually Bitcoin) for the unlock key.
• Data Breach: Attackers grab your customer data, your employee records, anything juicy. Then they either sell it or threaten to release it unless you pay up.
• Silent Extortion: Sometimes, it’s not flashy. Attackers reach out with a “we have your stuff” email and hope you’ll pay quietly.

“But when I looked at the stuff that was going on, I didn’t see any screens with ‘hey, send us Bitcoin.’”

Jack Smith, reflecting on a recent attack

Why Does Ransomware Keep Happening?

Simple: money. Attackers aren’t usually after you personally; they’re after whoever’s easiest to hit. If you’re big enough to be worth their effort, but not big enough to have a massive IT security team, you’re prime real estate.

---

How Attackers Get In

Ransomware doesn’t just jump in by magic. Attackers use all kinds of tricks, and usually, they just throw everything at the wall—emails with sketchy links, weak remote access, outdated VPN boxes, you name it.

Most Common Entry Points

1. Phishing Emails:
   Your employees get emails, and all it takes is ONE person clicking the wrong link. Suddenly, their credentials are compromised, and attackers can start encrypting everything they can touch.
2. Remote Access Weaknesses:
   Vendors and partners often need access to your systems. If their remote access isn’t locked down, patched, or is running out-of-date hardware… attackers love that.
3. Unpatched VPN Boxes:
   That cheap VPN unit tucked in a closet and forgotten? With no updates, it’s a goldmine for attackers.
4. Zero-Day Exploits:
   Sometimes, attackers get lucky and find a brand new vulnerability. If you’re slow to patch, it’s game over.
5. Cloud Chaos:
   With data scattered across various cloud platforms, attackers only need credentials for one spot to get everything.

Stick-to-the-Wall Principle

Attackers send out thousands of emails; if one sticks, they’re in. No need for fancy spying. Targeting is usually opportunistic—nothing personal. If an employee slips up, the company becomes the victim.

---

Why Training Your People Matters

You’d think IT staff would be the first place to start fixing things, but the real weak link is almost always a regular employee. The receptionist, someone in HR, finance—these are the people with access to critical information, and they’re the ones attackers target.

What Works: Employee Security Training

• External Party Training:
  Getting an outside expert to run training sessions, quizzes, and video tutorials shows employees what to look for and how to avoid disaster.
• Awareness Programs:
  It’s not just about technical skills; it’s about teaching staff to recognize phishing attempts, suspicious login screens, and out-of-the-ordinary requests.
• Recommended, Not Required:
  IT pros often skip these because they think they’re basic, but MOST people in an organization aren’t tech-savvy.

“I see a correlation between companies that do their training and tend to get affected less and those that don’t do that training and tend to get affected more.”
Andrew, on security awareness

The Human Factor: Don’t Blame

When something goes wrong, the worst thing you can do is start a witch hunt for whoever clicked the link. Instead, ask:

• How did this happen?
• Did everyone have proper training?
• Was everyone aware?

If you blame, people start hiding mistakes and IT ends up hunting for breaches blind. You can’t fix what you don’t know about!

---

AI Is Calling…and It Sounds Like Your Boss

Just when you thought email was the end of it, attackers are getting smarter. AI can now mimic voices in real time, and with enough stolen data, you might even get a phone call from your “CEO” asking for your password or cash!

Real-Life Story: AI Phishing Attempts

Andrew shared how he got a call from someone using AI-generated voice mimicking someone he knew. It took him a full minute to realize it was fake. Imagine a stressed-out secretary or new employee—they’d be sitting ducks.

“I’ve by now experienced my first AI generated phishing calls myself… It’s scary. I was able to look through it eventually, but it’s the ‘eventually’ that scared me.”

Andrew, seasoned IT veteran

How Banks Are Combatting AI Phishing

Some banks now have a nifty feature: when you’re on a call with them, your banking app displays a little icon confirming you’re genuinely speaking with the bank. If the icon doesn’t appear, hang up! Caller ID can be spoofed in seconds, so don’t trust just the phone number.

---

Data Leaks and Their Aftermath

So, let’s say the worst happens. Your data is out there. Attackers send you a sample, maybe your supplier calls and says, “Hey, your info is floating around the dark web.” (Yes, this is a real story!)

What Happens Next?

• Negotiation:
  Attackers demand payment, and you have to decide what to do. If you pay, there’s a reasonable chance they’ll keep their promise not to release the data, but there are no guarantees.
• Data Remains:
  Even if you pay, someone out there still owns your data. Ransomware “companies” have better backups than most businesses—they always keep a copy!
• Damage Is Done:
  Once the breach is public, you can’t undo it. Trust and confidence with your customers take a hit.

“The moment you are breached, it’s mostly over because you just have to trust that if you pay the other party that everything is going to go according to plan.”
Andrew on ransomware aftermath

---

Cybersecurity in Company Mergers

Mergers and acquisitions are ripe for chaos. Imagine the big company buys a smaller one, rolls out a press release, and suddenly the small company is bombarded with password reset emails and phishing attempts.

Weak Points During Acquisition

• Technical Blindspots:
  Law firms and executives handle mergers, but IT is usually the last to know. When the dust settles, IT staff find monitors with sticky-note passwords and legacy systems wide open.
• Stale Patch Levels:
  Smaller companies often lag on patches. When merged, attackers see the change and strike immediately.
• Staff Confusion:
  Employees suddenly get access to new systems and are overwhelmed. They click, open, and accept things just to keep up.

War Story: Acquisition Mess

Jack’s team once walked into a new warehouse, found screens asking for Bitcoin. Passwords were still taped to computers. Getting everything patched and secure took months, and during that time attackers tried every trick in the book.

“The acquisition moment is a hard one in general and it seems to be an opportunistic weak point for ransomware attacks.”

---

So You Got Hit: Recovery Steps

It’s not fun, but let’s say your company survives the attack. You paid, got your systems back, and maybe your data wasn’t spread all over the internet (yet). What’s next?

Steps for Recovery

• Train Your People Again:
  Don’t assume it was a one-time thing. Rerun your training. Make sure everyone knows how attacks happen.
• Patch Everything:
  Get every system updated. If you don’t, you’ll be back in trouble soon.
• Consolidate Your Data:
  Find out where your important files are and centralize them. Don’t leave reports and exports scattered across every SharePoint or cloud drive.
• Change All Passwords:
  Especially for cloud apps, vendor accounts, admin logins, and anything you can think of.
• Rethink Remote Access:
  Secure every external link to your company’s environment, whether it’s an accounting tool or HR platform.
• Enable MFA:
  Multi-factor authentication (MFA) isn’t perfect, but it makes you a lot less vulnerable to those stick-to-the-wall attacks.
• Check Your DNS and Email Settings:
  Use SPF, DKIM, DMARC. Sure, it’s a pain, but it helps prevent email spoofing.
• Check the Dark Web:
  Hire someone, if needed, to scan the dark web for your leaked data.

“It’s better to spend maybe an hour extra each week verifying emails as part of my tasks than to actually have someone misclick that. Because then you will have to spend a lot more time than one hour.”
Andrew, on prevention

Insurance Is Prevention

Think of security training as insurance. If you don’t pay for it, you’re rolling the dice. When things go wrong, the price is way higher than any insurance policy.

“If you don’t pay insurance for a car, you don’t maintain it, and then something goes wrong, you pay the full price for car repairs. Same thing for IT.”

---

Not All Hope Is Lost: Conclusion

We’ve seen it all—ransomware attacks, careless mergers, AI voices pretending to be your boss. But here’s the bottom line: most attacks aren’t super sophisticated. They’re just opportunistic. If you do the basics right, you’ll be a lot safer.

Practical Takeaways

• Train your people regularly; it’s the best defense.
• Patch everything—yes, even that old VPN box you forgot you had.
• MFA everywhere—apps, accounts, admin logins.
• Keep your data organized—know where it lives, don’t let it sprawl.
• Check your email settings—SPF, DKIM, DMARC make email spoofing harder.
• Support a security-friendly culture:
  • Don’t blame employees who slip up.
  • Encourage everyone to ask IT before acting on suspicious emails or calls.
  • Make IT approachable, not scary.

How We Sum It Up

“Most things can be seen as ‘see if it sticks.’ If it’s really targeted, we are talking about completely different things than what we’re talking about now. Train your people. Absolutely.”

---

Final Thoughts

Cybersecurity can sound scary, but you’ve got to laugh at the mess sometimes. Don’t panic, don’t blame—just fix, learn, and keep moving forward. Until next time, I’m Jack Smith (with Andrew’s help). Stay safe out there, and remember: your IT horror stories are only scary if you’re not prepared!