Labrador business targeted in ransomware cyberattack

A business owner in Happy Valley-Goose Bay is warning others about ransomware, a virus that infects computers and holds files hostage until the owners pay.

Bernard Bird runs a gardening store with his wife. They have five computers, all connected to one server. On Wednesday, a window opened on one of the screens, explaining their files had been encrypted and would be deleted if they didn't pay the ransom within five days.

"Things started happening weird," said Bird. "At that point, we couldn't even process sales. Everything is on that database: payroll, inventory, accounts receivable, payable, everything."

Ransomware is a growing threat to computer security and targets seem to be chosen at random. Sometimes private computers are hit, other times, it's major institutions, like Carleton University.

The ransom amount can vary, too. Bird says in his case the hacker asked for 3 Bitcoins, which is about $3,080 CAD. He says a text document appeared on his computer, with instructions on how to pay.

"Any attempts to restore your files with the third-party software will be fatal for your files!" the document threatened.

"Three thousand dollars isn't a small amount of money for a small business like us," Bird said.

As soon as he realized what was happening, Bird jumped into action. He started researching what to do and says he got conflicting advice from online articles — some telling him to pay, others saying he should go to the police.

Bird says he worried the ordeal might end up costing a lot more than what the hackers were demanding.

"How far are we going to go with this? Are we going to have to wipe all the computers? Install new operating systems?" he wondered.

"I've heard online people saying that they don't even trust those machines anymore so they got rid of them."

'No reason to trust' hackers will return files

Paying the ransom doesn't guarantee the safe return of files, according to Ramona Pringle, an assistant professor in the faculty of communication and design at Ryerson University.

"More often than not, what we're hearing security experts advising is not to play along with the hackers in these cases because they really are not to be trusted," Pringle said.

"It's worth keeping in mind that these are criminals and there's really no reason to trust that they're going to do what they say they're going to do."

Avoiding ransomware isn't easy, either. The virus could be disguised as an email attachment or a software update. Pringle says people need to be vigilant when it comes to opening files or clicking links.

Backing up files lowers the stakes

She also suggests backing up files regularly, so the stakes aren't as high if your computer is targeted.

That's what saved Bernard Bird from paying the ransom.

"I'm one of the lucky ones," he said. "Between myself and the tech support, which is really good for the software that we have, we were able to piece back together all the data and we didn't lose anything."

Bird relies on online cloud storage for day-to-day operations, but tries to backup his files offline every week or so. After his files were held hostage, he's even more cautious.

"Don't leave a hard drive plugged in to your computer," Bird said.

"If it's plugged in to your computer and your computer's plugged in to the Internet, it's vulnerable."

Now that his computer network is back to normal, Bird wonders if he has any legal recourse. He says the attack felt like a violation — not like a regular computer virus.

"It feels so personal," Bird said. "It feels like somebody took all your stuff, locked it away in a room and stood at the door and said, 'give me the money.'"

He says all the articles he has read online encouraged him to report the attack, but he couldn't find a way to report it online.

"I'll definitely hand it over to the local RCMP and see what they do with it."