MIAMI — The CEO of the Miami-based firm at the center of a global ransomware hack says that while measures are being taken to restore client access to critical files and infrastructure, cryptocurrencies remain a big part of the problem.
Fred Voccola, who has led Kaseya since 2015, told the Miami Herald on Thursday that one of the biggest takeaways from the July 4 weekend attack that forced Swedish grocery stores and New Zealand kindergartens offline and may have impacted as many as 1,500 companies is that cryptocurrencies must come in for tighter regulation.
“I’m not saying it should be legal or illegal,” Voccola said. “But we need to make sure that with financial transactions of all types, there has to be some kind of accountability. Otherwise, it’s not just ransomware — though 100% of (digital) ransoms happen with anonymous currencies like Bitcoin — but what about money laundering, human trafficking, narcotics, you name it.”
Cybersecurity experts say the anonymous group behind the hack demanded a total of $70 million in Monero, a cryptocurrency billed as “secure, private, and untraceable.”
Contrary to reports, Voccola said, it was not Kaseya itself that was ransomed but its clients. Cyber threat officials say the hackers were able to find a weakness in one of Kaseya’s products that allowed them to encrypt files of Kaseya’s customers, and that a ransom had to be paid to regain access to them. He declined to say how many may have paid.
In any event, the advent of cryptocurrencies has turbocharged the ransomware industry, Voccola said — though cryptocurrency advocates argue that restricting them would run counter to their spirit and would merely treat a symptom, not the underlying cause.
“With anonymous currencies, criminals don’t have to worry about getting caught — the risk-return is there,” Voccola said. “So you can commit crimes all day long. And the people who did this to us are really smart. So now, really smart people can commit crimes, and it’s a nominal risk because there’s no money trail.”
Jack Cable, security architect with cybersecurity group Krebs Stamos Group, said there is no consensus among cybersecurity experts about how — or whether — cryptocurrencies should be regulated, though many agree that cryptocurrency designers and the communities that help regulate them should consider integrating “know your customer” protocols. Even Bitcoin, he said, is merely pseudonymous — and not fully anonymous — since all transactions can be tracked.
A more holistic solution would involve banning ransom payments outright. While that would cause suffering to individual victims, society as a whole would benefit if such a policy helped deter cybercriminals.
In general, he said, the latest incident is yet more proof that companies can no longer look at cybersecurity as something requiring minimal investment.
Voccola said Kaseya, which is privately held and employs 275 workers at its downtown Miami headquarters, will likely lose “a few points of growth” in the aftermath of the hack, but that its long-term trajectory remains the same. The firm said in May it plans to hire 500 workers through 2022 — a plan Voccola said remains in place.
“The part of our business that got hit is an important one but a small one,” he said. “We have 1,600 people worldwide, and $400 million in recurring revenue. We might go from a 28% annual growth rate to 26% or 25%, but I haven’t really thought about those numbers as much. Right now, I’m trying to make sure every single one of our customers gets back online.”
———
©2021 Miami Herald. Visit at miamiherald.com. Distributed by Tribune Content Agency, LLC.
Copyright 2021 Tribune Content Agency.