Epiq’s Ransomware Response Is By The Books, But Dangers Still Lurk
In the aftermath of a ransomeware attack, Epiq Global is executing moves straight out of the cyber incident response playbook. However, the attack could still raise some interesting questions for how e-discovery providers will evaluate tools like cyber insurance moving forward.
By Frank Ready | March 03, 2020 at 03:13 PM
The e-discovery industry may have experienced one its most high-profile cyber incidents over the weekend. Epiq Global confirmed that it had been hit with a ransomware attack, prompting the e-discovery and managed services company to take its systems offline for the foreseeable future. A statement released by the e-discovery and managed services provider on Monday stated that “at this time there is no evidence of any unauthorized transfer or misuse or exfiltration of any data in our possession.”
What’s next for Epiq, its systems and the ongoing e-discovery projects they contain is still unclear, but at the moment it doesn’t appear that the situation is unfolding much differently from any other ransomware attack. Gulam Zade, CEO at LogicForce, stressed that while e-discovery vendors may appeal to bad actors for many of the same reasons that law firms do—access to sensitive information and a duty to preserve client data—ransomware has always, and will likely continue to be, industry agnostic.
“This isn’t going away. You have to be diligent about what you’re doing on the cybersecurity side, or you could end up like this,” Zade said.
Epiq has yet to reveal a timeline for when its systems will be brought online again. Still, even that measure is nothing too out of the ordinary. Per Zade, taking a system offline in the aftermath of an attack is a common feature of most incident response plans, but how high or low that step falls on the list varies depending on the company and circumstances involved. In the case of Epiq, the move could possibly offer some insight into the scope of the attack.
TechCrunch cited an anonymous source with knowledge of the situation who claimed that that the ransomware hit Epiq’s “entire fleet of computers across its 80 global offices,” but also noted that a company spokesperson had declined to confirm the extent of the incident. Whatever the number of computers involved, Zade said a business is unlikely to shut down over one machine infected by ransomware.
“If you’ve got ransomware that’s spreading and you can’t find the root cause and you are worried that it’s going to get to your backup system, which would cause catastrophic failure… you’re going, ‘Alright what’s worse? Three days of down time or going to everybody and saying, not only are we down, we can’t get your data back,’” Zade said.
Further complicating the aftermath of any cyberattack is the possibility that investigators aren’t just checking for ransomware, but signs of data exfiltration or other harmful programs. “Just because ransomware is part of the attack doesn’t mean it’s all of the attack,” said Marcus Christian, a partner in Mayer Brown’s cybersecurity and data privacy practice. He pointed out that a tech-dependent e-discovery vendor such as Epiq likely maintains ”very expansive systems,” which equates to a lot of ground to cover during an investigation.
But perhaps the most obvious factor influencing the duration of a ransomware investigation is whether or not companies choose to pay the ransom. Per Christian, many organizations do opt to pursue that route, but the decision can often hinge on whether a company has internal backups to rely upon or the extent to which the impacted data disrupts business continuity. “If it’s a small ransom, you may say ‘Well, it’s a good business decision,’” Christian said.
But while those concerns may not be the exclusive domain of the e-discovery industry, there’s still a good chance that the attack on Epiq will cause other vendors to sit up and take notice. Mary Mack, CEO and chief legal technologist at EDRM, indicated that while e-discovery providers have generally been stepping up their cybersecurity protocols, there are other lessons at stake here as well—like the importance of wide-ranging cyber insurance.
“The damages are going to be widespread. Did they insure against not only what they need to do to recover, but if somebody loses a court case or if someone gets sanctioned because they are not being able to use their systems, is that going to get covered?” Mack said.
This was originally published in LegalTech News on 3/4/20. Read the full piece here: https://www.law.com/legaltechnews/2020/03/03/epiqs-ransomware-response-is-by-the-books-but-dangers-still-lurk-2/