You just received a call from your IT administrator. Two different people, your Executive Director and your Head of Fundraising/Development, reported that their computers “were acting weird.” These individuals had difficulty finding or accessing specific files; then they received the following screen shot.

The IT Department has identified this as ransomware and believes it is migrating through your organization’s network computers and backup systems, locking up valuable files. The ransomware crooks demand that you pay 10 “bitcoins” within 24 hours to release your files. If you don’t, they threaten to double the amount every 12 hours.

Questions:
What effect will this event have on your organization?
What types of sensitive information do you maintain?
E.g. what types of sensitive personal information do you maintain? What types of program information could be at risk?
What Independent Sector Principles are implicated by this threat?
Will you communicate this event with stakeholders, and if so, a) what will you say, b) to whom, and c) when? If not, explain why not.
Do you pay the bitcoin ransom? Why or Why Not?

Category: Essays