Retail Observer

RETAILOBSERVER.COM SEPTEMBER 2017 62 W e were humming along at our office one Wednesday morning in May 2016, and I was rushing to get out of the office for a quick trip out of town. My last task to handle was to run our company payroll through QuickBooks. It's usually a clear-cut and quick process so I left the last 30 minutes or so to get it done prior to catching my flight. I logged into QuickBooks, and a worrisome message popped up advising me to immediately send a code to an email address to access my QuickBooks files. I called Benecom, our IT contractor, and they logged into my workstation to see what was going on. They took one look and informed me that we had a big problem; it appeared that my workstation had been attacked with a ransomware virus. Essentially what had happened was that the ransomware virus was blocking my ability to access our company QuickBooks payroll files and all saved documents in Microsoft Word. Initially, I thought that since we were backing up to our Office server and I was also backing up my QuickBooks program to a small portable external backup, that we would be able to restore the data. I later learned that Ransomware turned off our back up on the server and on the portable back up, when they blocked our access to our files. Benecom believes that the virus came in on an attachment from an email. A ransomware virus is exactly what it sounds like. The kidnappers take your files and hold them for ransom until you pay to get them back. Later we found out that if you don't pay within the time frame they initially give you, they demand more money and increase the ransom amount. Benecom brought in their representative who would negotiate on our behalf, with the ransomware virus kidnappers through emails. (I know at this time you're probably thinking this sounds a little far-fetched, but it's true.) As the negotiations began, the kidnappers demanded $3500 paid in bitcoins within 48 hours. We decided to contact the FBI and they took our information but advised that if we really wanted our files back, it may be advantageous to us to pay the ransom. They told us they would assign someone to the case who would contact us but they could not tell us when that might happen. After numerous attempts to extract the virus from the server and the portable back up, we decided to pay the ransom two and one- half days later. The ransom had to be paid in Bitcoin, which required cash being deposited into a Bitcoin machine. The only Bitcoin machine within a four-state area was located at Cafe Luna in New Orleans, about 5 miles from our business. We had not heard of Bitcoin before but found out it is an unstoppable way to evade capital controls, particularly illicit commerce. We arrived with cash in hand, and began feeding $100 bills into the machine until $3500 had been paid. We received a code, but did not receive a paper receipt for the transaction. Our negotiator gave the kidnappers the code we received, and advised that the ransom had been paid. Later that night, after long hours of waiting for our files to be released, the negotiator called to say that he had received an email from the kidnappers saying that unfortunately since they received the $3500 after the 48 hours had lapsed, that we would need to pay an additional $3500 within twelve hours. The kidnappers also apologized for the inconvenience. At that point, we knew they probably would never release the files back to us. While in Café Luna, the young cashier told us that since the Bitcoin machine had been installed, she had witnessed many upset business owners come in to pay ransom money into the Bitcoin machine, and that some of the Bitcoin customers were very angry with her. We contacted te owner of Café Luna to discuss the Bitcoin machine at his business; however, he was not willing to discuss it. Several weeks after the virus attack, an FBI agent contacted us and gathered documentation from us and Benecom, however, we have not heard back from the FBI. We still shake our heads in disbelief that this is allowed to go on, and that the authorities don't seem to be able to stop it. Corrine Caruso, Solar Refrigeration & Appliance Service, Inc S E R V I C E D E P A R T M E N T RO RANSOMWARE VIRUS: DON'T THINK IT WON'T HAPPEN TO YOU

• Cover