By 10:30 that night we had closed down each and every PC that we had and every one of our servers," Long reviewed about the Thursday night in January. "By midnight we effectively close off each PC in the association and began starting with no outside help. It's dreamlike.
By 4 a.m. on Friday, Long and his group had selected Indianapolis-based cybersecurity firm Pondurance to distinguish the reason and extent of the assault and kill the fast approaching danger.
Pondurance fellow benefactor Ron Pelletier said the principal need was to contain the interruption and assess what was influenced. Together with the FBI, which was brought in to help pinpoint the source of the assault, Pondurance specialists established that there was no simple method to eradicate the scrambled information from Hancock's framework and supplant it with clean information from the reinforcement framework.
Contemplating influenza episode and the snowstorm, Long settled on the official choice to purchase the unscrambling keys from the programmers. Late Friday night, Hancock purchased the keys by exchanging four bitcoin.
Bitcoin's was offering above $13,500 that day, bringing the assessed add up to Hancock paid to about $55,000.
"Criminal associations now are treating this like a business," Pelletier said. "They will design, they will ensure they see how they will execute and after that they will set out and see where they can execute."
Cybercriminals ordinarily utilize the final quarter of the year to search out "low-hanging organic product" and plan their assault, Pelletier said. At that point, in the principal quarter, especially amongst February and April — a period Pelletier has come to allude to as "break season" because of the uptick of digital occurrences — they put their arrangement without hesitation.
"Hancock is one association of numerous in this period this happened to," Pelletier said.
While the examination concerning Hancock's assault is progressing, none of the system's patient information seems to have been stolen, which Pelletier said meant that this specific gathering saw ransomware as a more compelling method for getting paid.
"On the off chance that you consider the quantities of ruptures that have happened by and large, [it's] a huge number of records," Pelletier said. "The dull web turns into a free market activity issue sooner or later — I can attempt to adapt PHI [personal wellbeing information] by offering it on the dim web, or I can presumably make possibly less, however a more facilitated installment in the event that I accomplish something like ransomware."