Langs Building Supplies: "We've been hacked!"

Overview

It was 4:00 in the morning, May 20, 2021. Matthew Day, CIO of Langs Building Supplies (Langs) was excited for a long-anticipated holiday after 14 months of lockdown due to COVID-19. His wife was thrilled. All of his friends, ecstatic. But the day took an unexpected turn. Instead of waking up delighted to leave for his getaway, Day woke up to every CIO’s worst nightmare, the dreaded phone call, “We’ve been hacked.”

Upon arrival at his office, he tried to bring up the system. Nothing. Instead, what came up was a ransom note, ‘You’ve been hacked’. This is when he realized, “This is not just an unplanned outage. This is a targeted attack. We were profiled,” said Day. “The hackers looked at our business and they took their time. They found a source that we trusted implicitly.” 

The hacker’s attack vector was a legitimate looking email that came from a proper email address, from the right account, in the right format. The one slight detail that was off was the link within the email. The link that Day’s accounting team typically uses to send purchase orders did not go to them. Instead, it went somewhere else.

Two weeks later, the hackers had access to Langs’ systems. They kicked off the malicious attack at 2:00 AM, when they knew no one would be around. “The hackers are smart. So the attack came in waves,” Day explained. The first wave was Friday morning when he got the call. Aaron Pritchard, Langs’ IT Systems Analyst, spent the day cleaning up their environment. Just when they thought they were able to go home, they decided to test the network once more. After logging in remotely, they realized they could not get in. “This was a pretty scary moment,” Pritchard said about being compromised again.

Read ransom note below

Solutions

"THE WAR IS WON. PEOPLE'S JOBS ARE SAFE"

There is an extreme amount of pressure facing CIOs, especially when there is no production happening in a factory that employs thousands of people. Day remarked, “When I have to send those people home, I take a personal hit on that. I feel personally obligated. Their livelihoods are in my hands. Not only do the implications of a ransomware attack hit home personally, it also implies revenue loss, production delays, and brand damage.”

After Day overcame his roller coaster of emotions from anger, to regret, to failure, he suddenly had this “ra-ra” feeling of knowing his team could handle this. “You think you’ve been successful in attacking us but here’s the counter punch. With Rubrik, we’ve got a very good right hook and we’re going to come back harder. At the end of the day, this attack is just going to be an inconvenience.”

“Rubrik was ticking away recovering all our data and I had this blinding flash of the obvious. We’ve been fighting battles all day but we’re at this point where I can happily declare ‘the war is won’. I knew that people’s jobs were safe. Rubrik is not just about recovering from ransomware. Rubrik is the difference between survival and non-survival in this new digital age,” Day remarked.