Wealth Management Firm Avoids $250K Claim

Invoking swift action and robust backup protocols, the firm successfully avoided what could have been a $250,000+ ransomware claim when a compromised VPN account was found for sale on the dark web.

Case study overview

A wealth management firm generating $500M in annual revenue across multiple business units faced a significant threat when a potential ransomware situation emerged. Their ongoing collaboration with the Cyber Risk Services Team equipped them with the necessary tools and strategies to effectively manage the crisis.

The challenge

Corvus received an urgent alert from one of its threat intel sources. A threat actor had compromised a VPN associated with the firm and was selling access to other criminals on the dark web. The firm needed to act quickly to prevent a potential ransomware attack. 

Corvus' response

Revoking access: The compromised VPN account was disabled to prevent further unauthorized access.

Investigation: The firm took the VPN offline for investigation, and discovered that the threat actor had gained access through a payroll account with a weak password after trying various combinations in a “brute-force” attack.

Enhancing security: The Corvus expert guided them in implementing Multi-Factor Authentication (MFA) on their VPN accounts to bolster security against future breaches.

Results

Once a threat actor sells access, a ransomware group is likely to strike within days. Thanks to the swift actions taken by the Cyber Risk Services team, the firm successfully mitigated an incident that could have escalated into a $250,000+ ransomware claim, but instead was contained to just a $3,000 expense.

The timely intervention not only prevented a potential crisis but also ensured that business operations continued with minimal downtime. No customer data was lost, so no reporting requirements were triggered that could have led to reputational harm. The incident underscored the importance of continuous risk management and the value of preparedness in the face of evolving cyber threats.