Hard lessons for some ransomware victims

The WannaCry ransomware worm that hobbled big institutions and businesses at the weekend, including FedEx (FDX.N) and Britain’s National Health Service, also indiscriminately caught many smaller victims across Asia, from hoteliers to Chinese students.

When MediaOnline, a firm that operates digital displays in Singapore shopping malls, noticed its displays were showing the ransomware’s pop-up window on Saturday, it sent engineers to two malls, director Dennis So told Reuters.

The company’s experience shows how the ransomware can sometimes be beaten without victims having to pay the $300 or so in bitcoin that hackers demand for a decryption key to unfreeze their computers.

MediaOnline’s So said only 12 computers were affected as the network was isolated from both the firm’s office network and those of the company running the malls, and its tenants. By replacing all the hard drives, reinstalling the operating system and downloading all Microsoft Windows (MSFT.O) updates, the computers were back up and running by early Monday, with So saying “no money or bitcoin was paid to the hackers.”

At some larger organizations, it took longer.

At Jakarta’s Dharmais Hospital, Indonesia’s biggest cancer center, up to 200 people packed waiting rooms after cyber attacks hit scores of computers. By late Monday morning, some visitors were still filling out forms manually, though the hospital said 70 percent of its systems were back online.

The unknown hackers behind WannaCry don’t appear so far to have been well rewarded for their global blitz, with about $50,000 worth of bitcoin transferred to the online wallets listed in the recent and earlier versions of the malware, according to bitcoin transaction tracker Elliptic Labs.

This may be partly because many of those infected, like MediaOnline, chose to restore their computer data from back-ups or by reinstalling the operating system. Others just held their breath.


Yang Lin, a journalism student at China’s Zhejiang University of Media and Communications, told Reuters she had just finished revising her thesis late on Friday and was closing Word on her desktop when all the Word icons blanked out, her screen went black and the hackers’ message appeared.

“I was connected to the university network. I didn’t open any link,” she said. “I just cried. I was afraid to believe it, but had to accept it.”

Yang said she thought about paying the ransom to unfreeze her computer, but gave up when she found out how much this would cost. Via a chat platform she discovered many of her friends faced the same problem.


She said she lost her literature review, foreign translations and thesis proposal, as well as films she had made over four years at college.

In Vietnam, hotel and restaurant manager Ngo Viet Yen said he was given 24 hours to pay 5 bitcoins (worth around $9,000) to save his files after his systems were infected on Friday. He didn’t pay, and reckons he’s lost around $2,000, and possibly more, as his staff revert to taking bookings, writing receipts and managing stock manually.

He noted that copyright infringement is widespread in Vietnam, and little is spent on system security.

“The number of computers updated to the latest version is very low,” he said. “And the server is rarely updated because there will be more issues and it often slows the system. It’s like: you only build a cage after losing your cows.”

Others found that even paying the ransom didn’t guarantee they’d get their data decrypted.

“We’ve seen some of our customers from the energy and health services who made the payment did not receive the decryption key in return,” said Budiman Tsjin, senior technical consultant at RSA, the security division of EMC Corp.