Ring! Ring!
Me: I.T. Department, this is Daniel. How can I help you, today?
Caller: Hi, Is this Dan?
Me: Yes, it is. And you are?
Caller: Hey, Dan, I’m glad I caught you. Steve over at ACME Co, gave me your information. Told me you are the man to get me out of the jam I’m in.
Me: OK. I will have to thank Steve for the referral. What is the jam you are in? Let’s see if we can work together to get you unjammed.
Caller: Well, I did something really stupid. I knew better, but I did it anyway. I opened a document in an e-mail. And now my computer is locked up with a screen about paying with bitcoins to get my data back. Steve told me you could fix this?
Me: Honestly, sir, I MIGHT be able to fix this. Do you have any other machi …
Caller: Hang on a second, Dan. <muffled conversation then the phone was put down>
A few minutes later …
Caller: Hey, Dan, I need you here, now! Three other computers are now showing the same thing on their screen. And the computers that are no, are not able to find their files on the server.
Me: OK. This is going to get worse. Power off ALL your computers. ALL of them. If you keep an infected computer online, it will infect the others. It is also possible that the computers you are NOT seeing the infection on are acting as carriers. Infected but not showing signs of the infection.
Caller: <expletives deleted> I can’t just send everyone home! I have work to get done, today! I can’t take the server down, because it is our online order system! <more expletives> It’s on the server, now! All my files are gone! I told you I needed you to come fix this! Where ARE you?
Me: OK. First, take a deep breath. Second, shut every computer down. Just do it. Third, I asked who you are and you have not told me. Just that Steve of ACME Co recommended me. So, how am I supposed to know where to go to get there to help?
Caller: OH. I’m Dave. I own VIP Online Sales. It’s an online mail order solution. I order stuff from China that I see moving well on Amazon and other sites. Then I sell it, for more, after it arrives here with a quicker turn around.
Me: OK, Dave. I need to know a few things, before I start heading your way. First, what anti-virus solution do you use?
Dave: Norton or Symantec. They are the same, aren’t they? Let me check. Yeah, It’s Symantec, on my machine. But it says it have expired. That means it was still working, right?
Me: Dave, the second thing I need to know is, do you have good backups of your server and are they recent?
Dave: No. No I don’t I was getting these messages, all the time that the backup drive was full.
Me: And how long has that been going on?
Dave: I don’t know. A few weeks, at least.
Me: OK, Dave. I’m on my way over. We will see what we can do about this. But you need to be prepared. This is NOT going to be cheap. And I doubt it will be quick. But I will do everything I can to get you back online, just as quickly as I can.
Dave: Like how much?
Me: I don’t know, Dave. I do not know which attack you are under. I do not know if there is a freely available decryption tool or if the ransom may need to be paid. I do not know how many computers you have, all of which will probably need to be scanned and cleaned, at the very least.
Dave: Can’t you like fix one of them and use it to fix all of the others?
Me: No, Dave. I’m sorry. But it just does not work that way. Where do you stand with Cyber Insurance coverage? Depending upon your policy, that may help with some of the costs of recovery.
Dave: I don’t have any. I thought it was a scam from the insurance companies to make money.
Me: OK, Dave. I’ve got your address from your website. I will be right over.
I arrived 15 minutes after hanging up the phone. The doors were locked. I knocked because I saw people moving around inside. A young lady answered the door.
YL: We are closed.
Me: Is Dave around? I’m the computer guy he called a little bit ago. I’m here to try to help.
YL: You are going to rape him over this. I could bring my son in here to fix these computers for less than you will do it for. We are all losing our jobs because you won’t do what is right and just fix it.
Me: May I speak with Dave, please?
YL: Dave left, already. You should, too.