A University, a Casino and a Crypto Exchange Were Hit This Month. What Small Businesses Should Take From It

In the space of two weeks, a university told its whole campus to switch off their computers, a casino resort went cash-only, and the world's largest crypto exchange explained how it lost more than $6 billion. None of them is a small business. All of them were hit in ways a small business can be hit too.

Here is what happened in each case, and what to check in your own business this week.

Vanderbilt University: a campus told to power down

On Monday, November 9, Vanderbilt University asked students and staff to shut down university devices and disconnect from campus Wi-Fi while it responded to a cyberattack, Axios reported. A ransomware group has claimed responsibility and says it took more than one million Social Security numbers. Vanderbilt has not confirmed that any data was stolen, so that number is the attackers' claim and nothing more. Some services started coming back the next day.

What to take from it: the first cost of ransomware is not the ransom. It is the day everyone is told to stop working. We walk through how these attacks unfold in our post on ransomware and small businesses.

Turning Stone: three days of cash only

On November 2, a cybersecurity incident at Turning Stone Enterprises in upstate New York left its casinos, a hotel and its convenience stores taking cash only, according to the Rome Sentinel. ATMs went offline. The company said it shut systems down itself as a precaution and had no indication that confidential information was accessed. It announced it was back up and running on November 5, and it has not said what caused the incident.

What to take from it: ask what your version of "cash only" would be. If your systems were off for three days, could you still take orders, bill clients and reach your customers?

Binance: it started with a job interview

On October 29, more than $6 billion was taken from Binance, and the FBI has attributed the theft to North Korea. Binance's own report, as covered by The Hacker News, traces it back to two ordinary moments. In June, an engineer searching for a popular AI coding tool downloaded a tampered installer. In September, someone posing as a recruiter put another engineer through two interviews, then asked him to download an "assignment" onto his work computer. It contained malware that Binance says its security tools did not catch at the time.

What to take from it: nobody picked a lock. Someone was asked to do something that looked normal, and did it. That is the same reason phishing has become so hard to spot.

DreamHost: when the breach is at your vendor

Web host DreamHost told customers this month that an attacker exploited a flaw in its online File Manager from about August until October 23 and got hold of FTP and SFTP usernames and passwords, along with some webmail logins, GBHackers reported. DreamHost reset the affected passwords and told customers to change any other account where they had used the same one.

What to take from it: you can do everything right and still have a password exposed by a company you pay. A reused password turns their breach into yours.

Five checks to run this week

1. Two-step verification on every account, including the owner's. We require it for every client we manage. A stolen password should never be enough on its own.

2. A different password for every service, kept in a password manager. This is what contains a vendor breach like DreamHost's.

3. A rule for installs. Nothing gets installed on a work computer because a recruiter, a vendor or a search result said to. Requests go through whoever manages your IT.

4. A plan for a systems-off day. Who calls whom, how you keep taking payments, and where the contact list lives when email is down.

5. Backups you have actually restored from. This one deserves its own section.

Backups: 3-2-1 is the start, a restore is the proof

Most backup advice stops at the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site. It is a good rule, and it is not enough.

Ransomware crews look for backups before they lock anything, so at least one copy needs to be somewhere an attacker inside your network cannot change or delete it. And a backup job that reports "success" every night only tells you that a copy was made. It does not tell you the copy opens, that it holds everything you need, or how long it takes to get back to work from it.

The only way to know is to restore:

• Every month, restore a single file and a full folder, and open them.

• Once or twice a year, restore a whole system, such as your file server or accounting database, somewhere separate from the live one.

• Time it. How long that restore takes is your real recovery time, whatever the plan on paper says.

• Write down what went wrong and fix it while nothing is on fire.

Our backup and disaster recovery service keeps backups configured and monitored, and we run test restores for our clients, so you know your data comes back before the day you need it. If you want the full picture, our guide to building a backup and disaster recovery plan covers recovery targets, off-site copies and who does what during an outage.

Where Huntress fits

Everything above lowers the odds. Nothing makes them zero, and Binance is the proof: its own tools missed the malware. That is why someone has to be watching for the signs of a break-in after the fact, at any hour.

Nexus Ideal Solutions is a Huntress partner. Huntress's security operations center provides 24/7 detection on the computers and business email accounts it covers, with analysts who investigate suspicious activity instead of leaving you an alert to work out on your own. It is a core part of the cybersecurity service we provide.

If you could not answer one of the five checks above, that is the place to start. Contact us and we will go through them with you.