“Don’t let us be blackmailed”: CEO Michael Wanner explains why CH Media doesn’t pay ransom

A ransomware group that stole data from CH Media and NZZ published some of it on the dark web. Could this have been prevented if the ransom had been paid?
Michael Wanner: I do not think so. Even if you pay, you cannot rely on the blackmailers to keep to agreements and not to impose further conditions. You also have no control over whether stolen data is published or resold

Three out of four companies blackmailed by a cyber attack end up paying the ransom. Why did you choose otherwise?
Even though a cyber attack is extremely annoying for everyone involved, it was clear to us from the start: we would not allow ourselves to be blackmailed. Due to negotiating and investigative tactics, we were previously unable to comment on the ransom demand from the extortionists.

Was it purely economic, financial considerations – or did you, as the boss of a media company, also refuse payment on grounds of principle?
We firmly believe that we must defend against all forms of criminal activity, including cyber-attacks. The payment supports such groups and indirectly funds further attacks against new victims. We must not bow to criminal machinations. Law enforcement agencies, with whom we work closely, also generally advise against paying ransoms for ransomware attacks.

What was the amount the blackmailers asked for?
On the advice of the experts of the federal government and the police, we cannot go into this further.

How sensitive is the data illegally published on the dark web, and what could happen next?
We are working hard on the forensic analysis of the stolen data, but have not yet been able to complete it. The cybercriminals have threatened to release more data in the coming days. We will continuously analyze the published data and, depending on the findings and the sensitivity of the information, inform the data subjects directly. We are committed to protecting the data of our customers, employees and our company. That is why we consistently act against the further distribution and unlawful processing of the stolen data.

Newspaper subscribers only received one regional quire for about four weeks because of the attack. In Germany, there were publishers who were technically blocked for more than a year. How could the problem be solved?
CH Media and the NZZ have developed a cybersecurity strategy to prepare for possible attacks. Thanks to this good preparation, it was possible to recognize and isolate the attack at an early stage. Immediate action was taken and control of the systems was quickly regained.

Ransomware attacks have increased across Switzerland. Shouldn’t CH Media have been warned?
Any organization can become a victim of a cyber attack, even if you have prepared for this scenario and taken protective measures, as we did. It is not only our own concern that demonstrates the situation once again: cybercrime in all its forms is a major threat to society and the economy as a whole.

The companies are challenged, but so are the authorities. What should I do?
The subject is high on the political agenda. From my point of view, different ideas should be specified, such as the regulation of cryptocurrencies, cybersecurity at continental borders or international research instruments.

You’ve only been CEO for a little over a month. You imagined your start differently!
Is correct! However, unexpected challenges come with exercising this role. I am very grateful that I can count on a strong team and highly motivated employees here at CH Media. The whole company is helping to take on this challenge, that’s the positive.