Overcoming a ransomware attack
A ransomware cyberattack crippled the plant control server environment of a major international juice producer. Hackers demanded payment in return for access restoration. Tetra Pak supplied a critical system backup that successfully reinstated full operations.
Customer challenge – urgently restore disabled server
A sudden ransomware attack infected the customer’s plant control server environment with malicious code. Hackers encrypted and disabled the server and relevant backups. Without the server data, the customer could not prove to regulators that its product was safe to sell. The cybercriminals demanded a ransom to unlock the server and enable sales to resume. They threatened to publish sensitive data if the company failed to pay.
The customer did not wish to pay the ransom. However, it had not adequately maintained its firewall protection and did not store offline or off-site backups. Effective backups are essential for rebuilding data infrastructure from scratch in a short time frame.
Our solution – restore from backup
The attack occurred on a Sunday evening and the customer contacted Tetra Pak’s Global Information Management & Process Office the next morning. We immediately assembled a six-person team led by an incident response manager and including four automation specialists and a legal expert.
Our technicians had saved a full backup of the customer’s server during a routine maintenance visit some months earlier. We used this backup to restore the server infrastructure and fully reconfigure it remotely before sending the data to the customer for implementation. Sales were able to resume in one week, and the restored infrastructure avoided the need to pay a ransom.
Results achieved – higher awareness and improved readiness
The experience increased the customer’s awareness of how preventive measures are crucial to guarding against cyberattacks. The company adopted a range of actions for improved resilience, including remote support from Tetra Pak and processes to ensure the keeping of comprehensive and updated backups, including offline.
Case in short
Incident duration: One week, November 2021
Objective
- Restore fully functioning plant control server environment after cyberattack
- Avoid need to pay ransom demanded by malicious hackers
Results
- Re-establishment of full functionality in one week
- Preventive measures put in place to reduce future vulnerability
Want to discuss further?
Discuss the cybersecurity challenge for food and beverage producers and how you can protect your systems against cyber threats with us. Regardless of your size and level of automation, together we’ll find the right solution for your plant and needs.
Get in touch to discuss your challenges.
