Hela ransomware: backups on the same system
The 31 August 2021 presentation describes a listed company’s 28 July incident. Staff lost access, files acquired an .hela extension and the backup drive on the same domain controller was encrypted too. Responders checked logs, notified authorities and attempted recovery tools; these did not restore the encrypted operational data. Separate and test backups rather than assuming a connected backup is safe.
Data theft and extortion
In a second scenario, a CEO received personal details of five senior staff, then evidence of access to HR and customer records, followed by a demand for two bitcoins within 24 hours. Lack of obvious initial signs did not mean no compromise. The lecture explains why ransom payment is not recommended: recovery or non-disclosure cannot be guaranteed and payment can encourage further crime.
Historical 2020 threat table
The slides reproduce figures from CSA’s 2020 landscape and give the presenter’s risk labels. These are historical measurements and teaching labels, not current national risk ratings.
| Threat | 2020 figures | Slide risk label |
|---|---|---|
| Ransomware | 89 cases; 35 in 2019; 154% increase | High |
| Botnet drones | About 6,600 detected daily; about 2,300 in 2019 | Low |
| Phishing | Over 4,700 COVID-themed malicious URLs spoofing local services | High |
| Website defacement | 495 .sg websites; 873 in 2019; 43% decrease | Moderate |
| Online cheating | 12,251 cases; 7,580 in 2019; almost 62% increase | Low |
Home working and information protection
Secure home Wi-Fi with authentication and encryption. Verify unexpected links or files through an independent channel, protect email with multi-factor authentication and do not move confidential records to personal accounts. Do not disable antivirus or reconfigure work devices for unauthorised sharing.
The presentation’s categories include cyber, technology and information risks; collaboration tools, vendors, insurance and digital exposure all affect the risk profile. Escalate suspicious activity to the local IT or response team.
Governance and legal review
The board and management should include technology risk in enterprise risk management, support continual education and stay informed. The source’s short PDPA notification explanation must not be treated as a universal deadline for every incident: assess whether a breach is notifiable and follow current PDPC requirements. Historical news, vendor examples and funding references are not current guarantees.
Information risks beyond hacking
The illustrated examples include the SingHealth patient-data breach, the Singapore HIV-data leak and unshredded customer records. Together they distinguish malicious intrusion, access or handling failures and physical document disposal. Remote-work questions cover device suitability, Wi-Fi security, VPN use, authorised access, partner collaboration and staff education. The PDPA slides distinguish notification to PDPC from notification to affected people, emphasising significant harm or significant scale in the former; consult current PDPC rules for the exact assessment and deadlines.