‘Ransomware’ attack locks down law firm’s files for three months

April 29--PROVIDENCE, R.I. -- An unknown person or group held a Providence law firm captive for months by encrypting its files and then demanding $25,000 in ransom paid in anonymous cyber currency to restore access, according to a lawsuit filed in U.S. District Court.

Moses Afonso Ryan Ltd. is suing its insurer, Sentinel Insurance Co., for breach of contract and bad faith after it denied its claim for lost billings over the three-month period the documents were frozen last year by the so-called "ransomware" attack.

During the time its system was disabled, the law firm negotiated ransom to be paid in bitcoins, cyber currency that is virtually impossible to trace, the suit says. The firm then had to re-negotiate those terms after the initial key to de-crypt its records failed to work. It arranged to purchase more bitcoins in exchange for other tools to recover its documents.

During the seizure, the firm's 10 lawyers were left unproductive and inefficient -- amounting to $700,000 in lost billings, according to the lawsuit.

Stephen A. Izzi, a principal in the firm, did not return a phone call placed to his office or an email seeking comment. Another principal, Mark T. Ryan, former executive vice president of the Providence Journal Co., also did not respond to an email request for comment.

The Westminster Street firm is not alone in falling victim to such a crippling attack. Police departments, town halls, law firms, accounting firms and individuals have been hit across Rhode Island, according to Capt. John C. Alfred, head of the the Rhode Island State Police cyber-crimes unit. Alfred declined to identify who filed complaints about the cyber strikes, but estimated that about 20 had been fielded by his agency in the past year.

"It's gotten crazy. They're making billions of dollars," Alfred said of the attackers.

What makes "ransomware" attacks particularly bedeviling to law enforcement is that the culprits remain unknown due to the use of untraceable currency. The strikes might be waged by someone working alone in a basement who purchased ransomware on the dark web or criminals based in Nigeria and the Eastern Bloc, as is often the case. They could be random or targeted.

"Chances are we're not going to find out who the bad guy is," Alfred said.

And the strikes are prolific. They are one of the top emerging cyber threats, according to the FBI Boston division.

American businesses and individuals in the thousands suffered more than $1.6 million in losses in 2015, and rose to about $2.9 million in 2016, according to federal internet crime analysts.

Attackers are tailoring their demands to their victims, in essence making it a brand of "valet thievery," said cyber expert Doug White, director of forensics, applied networking and security at Roger Williams University.

"We haven't really seen them remove the data," Special Agent Jeffrey Williams, of the FBI Boston division, said. "We've seen them encrypt it ... hoping for a payout.

They might demand $800 from a household, and push that sum into the thousands if they realize they've hit a law firm or hospital, White said. The infecting software jumps from computer to computer rapidly and even accesses data held in a cloud, locking up every file permanently through encryption. They key to the attacks is that someone has to hit on a corrupt link to let the malware in.

It's a crime, too, that is vastly underreported, law enforcement agencies say.

"The shame of it keeps it from being reported," White said, as businesses don't want to sully their image or reveal weakness. "Usually they just pay them off. It's the cost of doing business."

The FBI, like the state police, urges victims not to pay the attackers. Both agencies say that encourages more attacks and that the money in play could be used to fund serious crimes.

"I never tell anyone to buy the ransomware key because it's sponsoring illegal activity," Alfred said. He added: "You have to back-up the data beforehand. That's what you have to do. You're not going to get that data back. Even if you pay, you might not get the key."

Protecting a network involves everyone in it from a janitor to the CEO, Alfred said.

The FBI requests that victims of attacks reach out to the agency and file a complaint with the Internet Crime Complaint Center, at www.IC3.gov.

Dana M. Horton, representing Sentinel Insurance in the lawsuit, also did not immediately respond to an email and a phone call seeking comment. The company has not yet filed a response in U.S. District Court.

White questioned whether the law firm's suit would succeed, saying it would "open a giant can of poison worms" for the insurance industry. Alfred, too, emphasized that cyber security insurance is a growing field.

"Everybody is going to be insuring their data," Alfred said.

___

(c)2017 The Providence Journal (Providence, R.I.)

Visit The Providence Journal (Providence, R.I.) at www.projo.com

Distributed by Tribune Content Agency, LLC.