UK council won't say whether two-week 'cyber incident' impacted resident data Leicester City Council continues to battle a suspected ransomware attack while keeping schtum about the key details. Progress updates posted to its website are still referring to the widespread outage as a "cyber incident," failing to even confirm whether data has been compromised or whether ransomware is involved, which some …
That'll be in the communicate section, comes after the first two. I suspect they're struggling to fly the plane, and won't pull the recovery chute as that removes all other options
Navigating a "cyber incident" (let's be honest, it's proably ransomware and they're probably fucked) is hard, I know, I've done it.
I suspect those on the ground haven't told those at the top how fucked they are yet...
I've done a full - take half the servers in the company down - Ransomware attack.
Now my company doesn't have the finest IT dept on the planet but there's nothing like a crisis to bring everyone together. Had our core back within 3 days and the long tail of random shizzle back within 2 weeks.
Helped by paying the ransom - which I'd tend to advise unless your running active-active or hot backups and have some way of firewalling the secondary/backup from the ransomware.
Thing about ransomware its clever and insidious and can be running for a significant period of time encrypting random files until it hits a critical one. So your backups get "corrupted" to.
As does your OS.
So you are looking at server wiping, Data Loss and probably manual recovery -- if you are lucky. Much cleaner to decrypt in place with the key - if the ransom folks are remotely trustworthy. And they generally are on this. Because they want to get paid every time.
We were able to crash push Jenkins + a Ransomware killer + a decrypter out to every machine in the estate and essentially run massively parallel decryption. Hardest bit was getting Jenkins on the 10% of awkward servers who refused the push or were too full of encrypted files to receive anything.
BOFH Cattle prod of doom for you.
IT Estate is not a plane.
ITIL (or any other framework worth its name) has an Incident Management process that includes a role for Incident Comms, that should cover all your user stakeholders including the general public .... and for which the press is a valid comms channel.
Your ERP goes down and you're not giving the CFO hourly updates on the expected recovery time and process - your IT dept is a clown car.
Its been 20 years since I've done IM. This is basic stuff.
"Your ERP goes down and you're not giving the CFO hourly updates on the expected recovery time and process - your IT dept is a clown car."
The best responses here are along the lines of "It'll be back when it's back. Now get off my back." or "Do you want me to fix it or stay here talking to you about fixing it?"
As to the OP's comment he is actually saying the same thing as you and making the point that what both of you are recommending isn't being done in this case.
you can only ever have 2 pilots.
Wrong. There used to be three pilots in an airliner cockpit! "Flight Engineer" used to be a cockpit job, with said engineer being a fully-trained pilot. When things are falling apart, I want as many trained human minds in the cockpit working on the problem(s) as possible.
Airlines bribed/pressured the world's civil aviation authorities to allow them to put just two pilots in the cockpit (because that costs them less money), saying some booshwah as, "Electronic Cockpit ... automations reduce pilot workload ... thick brown envelope for you here ... also photos of you with your secretary on the Riviera ... stunning profile, ought to be in the Sun ... your wife surely is the understanding type ... middle-aged fling ... blockchain ... crypto ... AI ... (insert more buzzwords here, relevant-or-not).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
