Ransomware attack sends Isentia spiralling

Investors savaged the media monitoring outfit after learning the attack would cost up to $8.5 million.

Ed Harrison, Isentia managing director

Investors savaged Australian media monitoring outfit Isentia on Tuesday, cutting its market value by one third after the company revealed the cost of a ransomware attack to its bottom line.

Isentia, which joined a growing list of high-profile ransomware victims including Toll, BlueScope and Lion, told the market on Tuesday the attack on its cloud platform would cut annual profits by between $7m and $8.5m.

Restoration of services on its Mediaportal platform were ongoing, after a cyber security attack last week “severely compromised” the delivery of services to customers.

While the platform was back to operational state on Tuesday some key services remained affected, Isentia said.

Investors pummelled the company, sending its shares down 32.4 per cent to 12c each.

The company told investors it would take a significant hit from the attack, with the immediate impact on the company’s net profit before tax expected to be a hit of between $7m and $8.5m for the 2021 financial year, which the company said reflected customer remediation costs and revenue foregone during the outage.

At close on Tuesday the company had an entire valuation of about $25m.

“Isentia responded rapidly to the cyber security attack last week putting in place measures to support our customers and contain the impact on our systems,” chief executive Ed Harrison said.

“We are pleased to report that we are making good progress in resolving this issue, with key elements of our service being restored each day and I would like to thank our customers for their patience during this time.”

A growing number of ASX-listed companies are falling victim to ransomware attacks, with executives often left with little choice but to pay the “ransom” in order to regain access to sensitive customer and operational data.

Hacker.

Ransomware is malicious software that blocks access to data until money is paid. Isentia declined to comment when asked whether it paid the ransom.

Jamie Humphrey, the managing director of data management and enterprise back-up provider Rubrik, told The Australian that 2020 had been a bumper year for successful ransomware attacks.

“Ransomware’s ability to bring a business to its knees led the Australian Cyber Security Centre to name it one of the most significant threats facing Australian businesses in its Annual Cyber Threat Report,” he told The Australian.

“Once you lose access to your data, it’s almost impossible to operate. The ‘open’ sign flips to ‘closed’ until you can regain your data and repair systems. Beyond the cost of remediation, there’s also the cost of lost productivity – which in some cases can be weeks or months.

“While it’s impossible to be completely protected against a ransomware attack, it is entirely possible to ensure your business can get up and running quickly in the event of a breach. It comes down to two simple words: ‘back up’.”

According to Mr Humphrey, businesses who do deploy a comprehensive back-up strategy can easily turn back the clock and restore data to a ‘save point’ from before an infection occurred.

“The more frequently snapshots are taken of business-critical data, the quicker the business can return to normalcy,” he said. ”This was also highlighted in ACSC’s report which said ransomware recovery was almost impossible without comprehensive backups.”

John Donovan, managing director of cyber security provider Sophos, said the attack highlighted that ‘time is of the essence’ when it comes to ransomware.

“Every minute between initial compromise and neutralisation counts as adversaries race through the attack life cycle,” he said.

“Advanced attacks can quickly halt business operations, and IT managers who have experienced this first hand know this all too well, reporting the need to spend proportionately more time on incident response and less time on threat prevention than those who haven’t been hit.

“IT security teams need to be on full alert 24 hours a day, seven days a week and have a full grasp of the latest threat intelligence on attacker tools and behaviours.”