A luxury hotel in the Alps was attacked by ransomware leaving guests locked out of their rooms. The Romantik Seehotel Jägerwir in Austria was forced to pay the cybercriminals a couple of thousands in Bitcoins to have their locking system unlocked. Having being the third attack of its kind, the 4 star hotel went public with the reports to warn others about the dangers of cybercrime.
Tyrone Erasmus, Director of MWR InfoSecurity believes that the attackers were strategic when attacking the hotel. He says, “This is an interesting case as the technique used to hold the hotel to ransom was unconventional and entirely targeted. Commonly, ransomware affects the availability of data held by businesses but in this case the attackers understood that denying access to hotel rooms would be an effective way to extort money. This was a targeted attack against the hotel’s room access control systems with the intention of extorting money, indicating that the attackers may well have already had a foothold within the hotel’s IT system”.
After the attack, the hotel replaced their existing system and delinked some computers in an effort to prevent future attacks, according to reports by The Local. A traditional locks and keys system which the hotel used when it first opened is another measure taken by the hotel.
Erasmus say, “Having a layered defence model that makes use of prevention and detection controls would have helped this business identify and defend against this attack. Criminal syndicates are evolving rapidly and new and unique ways to hold critical systems within a business to ransom can and should be expected”.