A story we hear too often
The morning thirty years of drawings became a ransom note
the principal of a 22-person architecture studio
Sam Reyes founded the studio in 1994 in a loft on Hubbard Street. Twenty-two people now, a hospital wing under construction, two schools in design, and a project server that holds every drawing the firm has ever issued. Thursday is the draw request for the hospital: $1.4 million to the contractor.
At 7:20 on a Thursday the office manager cannot open the project server. Every folder has a new file in it, and the file is a letter. It explains that thirty years of drawings are encrypted, that copies have been taken, and that the price goes up on Monday. The Revit models for the hospital wing are in there. So are the schools.
In the version that closes a studio, the backups were on the same server, the contractor’s draw request that morning carried new bank details from a compromised sub, and the firm learns in the same week that its drawings are for sale and its money is gone.
In Sam’s version, the offline backup from Wednesday night is intact, the engineer on watch had isolated the server at 4:12 a.m. when the encryption began, and the draw request goes out at noon after a phone call confirms the contractor’s bank has not changed. The hospital does not know. The studio loses a morning, not thirty years.
It explains that thirty years of drawings are encrypted, that copies have been taken, and that the price goes up on Monday.
What changes the ending
- Offline, tested backups of the project server, the models and the drawing archive (CIS Control 11, Data Recovery)
- A call-back rule on every draw, pay application and bank change, with project mailboxes under MFA (CIS Controls 5, 9 and 14)
- Endpoint protection and a watched network that isolates a server at 4 a.m., not at 7:20 (CIS Controls 10 and 13)