Case Study: Global meat and food processing company shut down by a cyber attack On 30 May 2021, JBS Foods, a global meat and food processing company, was compromised by the Sodinokibi/Revil ransomware syndicate. The incident led the company to proactively cease operations and stand down workers across facilities – including in Australia – while it investigated. On 9 June 2021, JBS USA confirmed it paid the equivalent of $11 million (USD) in ransom to mitigate any unforeseen issues related to the attack and to provide assurance of no further disruption and to limit the potential impacts. This incident, along with other high profile ransomware incidents in the 2020–21 financial year against US critical infrastructure and the health sector in the UK and Ireland, highlights cybercriminals’ willingness to cause serious disruption – including financial, reputational and societal harm – for financial gain. Cybercriminals are specifically targeting entities whose services or data make them particularly vulnerable to extortion. However, this incident also highlights the benefits to victim organisations and other potential victims of close collaboration with the ACSC. At the time of the incident, the ACSC engaged with JBS Australia, their independent incident response provider and international cyber security partners, to provide technical advice and assistance, including remediation advice and confirmation of the ransomware variant. This close cooperation assisted JBS Australia to rapidly respond to the incident and quickly restore operational systems from backups. The ACSC subsequently was able to identify indicators of compromise associated with the ransomware activity and protect other potential victims across Australia from compromise. How to protect networks Organisations can protect themselves from ransomware using the ACSC’s tailored guidance below. Individuals, and small and medium-sized businesses Follow the steps in the ACSC’s Ransomware Prevention and Protection Guide: ■ Update devices and systems – update software and turn on automatic operating system updates ■ Enable multi-factor authentication – have multi-factor authentication enabled by default on any corporate networks, devices or systems ■ Backup data – set up and perform regular offline backups; these are essential for recovery following a ransomware attack. Backups must be stored offline or otherwise isolated from the corporate network ■ Implement access controls – restrict administrator privileges and do not share or re-use login details ■ Turn on ransomware protection – available on some operating systems. Prepare a Cyber Security Emergency Plan – prepare and regularly exercise this plan to ensure everyone is familiar with the processes and understands their roles. 34