40 years of heritage lost? What a cyberattack does to your team and organization

George Wilson is at Southampton Airport, on his way to their museum in Belfast to onboard new colleagues when he hears that something seems to be wrong with their systems. He is not overly concerned and suspects it has something to do with the aftermath of a disruption a few weeks earlier. When he lands, an hour and a half later, the devastation becomes clear. 

Three-quarters of the systems

Of the twenty digital systems, fourteen are completely down. Both the front end (ticket sales) and the back end (email, files, collection management) are encrypted by criminals.

Buying mobile payment devices 

In the first 24 to 48 hours, he tries to get a grip on the scope and impact. When three-quarters of your organization is down, you can't fix everything at once. Wilson and his management team had to make sharp choices. Their absolute priority was the ticketing system: 80% of the museum's revenue comes from ticket sales.  

George: “We immediately started buying those mobile card readers and payment devices that you can connect to a phone. Most people pay with their cards at our locations, so we absolutely didn’t want to leave visitors in the cold on that front.”

At the same time, there were immediate concerns: was visitor information and other sensitive data stolen? It ultimately took six weeks to completely rule that out. 

Prioritization and mental strain

The second priority was the systems related to the collection. 

“Until February, we truly had no idea what state the database was in. That uncertainty was terrible. You're talking about forty years of work that the entire team has built, and you simply don’t know if you'll ever access it again.” 

For a museum that revolves around heritage preservation, the uncertainty brought enormous mental strain to the team. Only after months of intensive research did it turn out that the database was fortunately intact. 

Manually resetting 400 devices

George's team wanted to ensure that no malware or viruses were present on laptops and phones. This large-scale organization operates from six locations across the United Kingdom. Everything had to be brought to one location, and around 400 devices had to be completely wiped and reset, which alone was a massive operation. It turned out there had indeed been tampering. 

Lessons for your own organization

Backups 

“I would want to shout it from the rooftops,” Wilson firmly states, "one of our most important lessons is about backups.” 

George: “Precisely that last piece, the offline backup, was missing at the time of the attack. As a result, we permanently lost some systems and had to rebuild them from scratch. 

How did they get in

The museum used Microsoft Defender, which luckily limited the spread of ransomware within the network. Still, the criminals found a loophole. The culprit turned out to be a vulnerability in a Microsoft Exchange server.

“It wasn’t human error, like a phishing email,” George explains. “They purely exploited a technical flaw in the system to sneak in.”

Nothing stolen

The handling of the attack was peculiar. No ransom was demanded, and nothing was stolen. A very strange situation, according to George. 

George: “It was truly a very strange situation. Normally, those guys leave a ransom note and immediately seek contact with you to negotiate. With us, it went differently. We did find a note, but it was clearly a sloppy copy-paste template. There was nothing specific about us in it. It only said: 'Come to this chatroom on the dark web, we’re waiting there to talk.' We eventually went to look, but no one ever showed up. Very bizarre.”

No concrete message, no demands for money, and no contact. The museum suspects it was some kind of opportunistic exercise.

Awakened

A year earlier, The British Library was attacked. “That really woke us up.” They were just in the process of improving their own online security, inspired by the learned lessons from the British Library, when the heritage organization itself was hit. 

That’s also the reason he participates in the podcast Cultuurshift: “If just one organization learns from our story, my mission is accomplished.”