Forty three percent of cyberattacks are aimed at small businesses, yet only 14 percent of those businesses, a staggering figure, are prepared.

On October 26, Vertican became among the 43 percent; we were also among the 14 percent of businesses prepared. Here are some key things that went on to happen that day:
• Shortly after midnight (eastern time), we received a notification by our security monitoring center, Azure, of suspicious network activity.
• Immediately following, Vertican’s CIO, IT Manager, IT Administrator, and I conferenced to make some crucial and quick decisions, beginning with proactively shutting down every node of the Vertican network.
• We contacted our insurance provider, hired an attorney, Lewis Brisbois, who specializes in cyber security, and enlisted a cybercrime forensics and incident response firm, Arete.

Concurrently:

• Our IT teams began restoration planning.
• Our business teams remained in communications with our clients.
• Our development teams began planning how to restore client facing applications for when system access was ready.
• Our Client Success team assisted our clients despite access limitations.

So, within 12 hours, we were collaborating and engaging the professionals needed to help us navigate through this incident. Within seven days, we contained and eradicated any threats to the environment, and we were able to focus on restoration. Development on the Regulation F software enhancements immediately resumed, providing the Collection-Master, Q-Law, and Q-LawE releases in advance of the November 30 deadline.

So why did so much time pass before clients could begin processing claims through YGC and vExchange?

• Vertican had to wait for forensics experts to complete the investigation to confirm we had a clean network prior to reopening. Also, cybercrime is a federal offense and working with government agencies to investigate the incident was a grueling, complicated process. We were confined by the boundaries set forth by our attorney, forensic consultants, and the government in the information we could share. Once we received the incident report by Arete, we readily provided access to all vPortal clients.
• Vertican is an SAAS company that sends millions of pieces of data through our financial system daily. The intricacies involved in ensuring the security and integrity of such data before, during, and after that process is an enormous responsibility. And to safely return such operations to a business-as-usual state, we established controlled phases while collaborating, in part, with our largest Senders on procedures to restore backdated data.
• Loading and processing backdata, is a time-consuming, complex process when done right. We are grateful for the cooperation of our clients who followed the output file naming convention procedures to prepare for when the YGC and vExchange FTPs were ready to transmit data.

Nevertheless, it’s an understatement to say this was a frustrating time for our valued clients. I know important functions in your businesses were paused and impacted over the course of the incident. On top of the impact to daily business, our clients’ concerns about security were compounded by uncertainty due to the information access constraints.

Retrospectives and Lessons

We made the vital decision, many years ago, to invest in cyber security insurance. Many businesses do not have cyber security specific insurance. We were and still are today, cashflow ready, but insurance is more than just having money available, if needed. It allowed us to quickly and efficiently procure the expert services that we needed to get on this issue.

We also have individual leaders at Vertican that are responsible for components of the business. So, when this crisis hit, I didn’t have to sit down and start orchestrating what was going to happen first, second, and third. We have been building on that level of information management and flow for a while. That’s, not to say it was perfect. But I had quick access to the resources and subject matter experts Vertican needed to navigate this cyberstorm.

So, here’s what we learned that is critical to have in place:

• A cyber security insurance policy
• A team of leaders in position to take on challenges
• A well-vetted compliance policy and procedure to guide the team’s quick response to situations
• Sufficient cashflow to help weather pitfalls
• A rolodex of experts to call upon for help

Crisis Management’s (not so) Secret Sauce

I mentioned when crisis hits. In the value of not being first, we were able to learn from countless other companies from various industries. JBS Foods (the world’s largest food processing company), the NBA, and wait for it, the FBI’s email system being compromised, were among the dozens of high-profile cyberattacks in 2021 alone.

I remember when my parents taught me how to drive, they said to expect and prepare for the unexpected. That’s the way I look at the eventual cyber incident – like preparing a young driver to deal with a traffic accident.

This is where we need to be as an industry, we need to talk about it and not play Monday morning quarterback or lament over the unnecessary demise of a business.

Managed detection and response (MDR) services and end-point detection types of technologies should undoubtedly be part of your long-term security strategy. We are now monitored 24/7 by Arete’s, our managed service provider (MSP), security operations center.

I’m a big believer that a failure to plan is a plan for failure. So much so that I display a sign in my office that says Prior Planning Pays. If you live in an area that is vulnerable to hurricanes, either you move or invest in reinforced windows and stock up on sandbags for the inevitable. I’m not moving or changing my career, so I plan for the hurricane.

I do not expect this to be our last incident – disasters happen in every industry, in every country around the world. You and I are not immune. Let’s have each other’s backs.

I wrote an article in fall 2019, Alleviating (some) Chaos in the ARM Industry, about data standards. I wanted to challenge the industry perception that there’s a secret sauce in the form and format of the data we exchange.

If the recent attack on Vertican has taught me anything else, besides protecting client data while navigating a cyber security crisis in real-time, it’s that best practices for cyber safety also do not need a secret sauce. The exchange of security best practices should be shared in a precompetitive arena. This is the stuff that everybody needs to buy into to keep consumer information secure, especially knowing an attack is just a matter a time.

Precompetitive principles are shared in everything that touches our lives. For example, from the best safety practices and equipment standards used in school sports to that of the Olympics – coaches, parents, municipalities, businesses, and manufacturers all do something consistent that is in every athlete’s best interest. So, yes, after the precompetitive stuff, then it’s time for Friday night lights and cutthroat competition.

Another example, Volvo, formed in 1927, focuses on safety as one of its core values. When Volvo engineer, Nils Bohlin, patented his design of the first three-point safety belt in 1959, the company immediately released it into the public domain for the greater good.

What’s Next? Precompetitive Alliances

While no client data was affected during the cyberattack, we all treaded waters of uncertainty as we awaited the forensics report. Vertican is now harnessed and resourced with our best foot forward, so expect many different security enhancements to come down the pike from Vertican.

What I wouldn’t give to have avoided the ordeal brought on by the dark web’s finest scumbags. What I wouldn’t give to save each Vertican client the stress, worry, and raw fear not knowing exactly what was going on during the initial first days. What I wouldn’t give to ensure that each Vertican client, partner, and even counterpart and competitor benefit from our experience.

So, enter 2022 with your helmets and shin guards off, because Vertican is getting precompetitive. We will be partnering with ARM industry leaders to hold a Precompetitive Security Summit to help improve security practices across the collections industry. There’s no secret sauce.

The world is feverishly changing, and it’s not lost on us as a business that compliance did not exist in this industry a mere 10 years ago. I’ve been to hundreds of conferences and had countless conversations where we looked at compliance as more of an annoyance than anything else. And now, with a V8 hand slap to my head, I’ll admit that was like being annoyed at the fact that you must wear a seatbelt – until it’s the seatbelt that saves your life.

Anyone not preparing for a cyber vulnerability incident is running a fool’s errand. From Q2 to Q3 2021, ransomware gained increasing attention, so much so that the U.S. government identified it a national security threat. We are all in the thick of it together. Threat actors are only continuing to exploit the most esoteric vulnerabilities in your system.

The cyber crisis Vertican experienced was handled as well as it was because we’ve been setting ourselves up for the unexpected. This will be true tomorrow, five years from now, and so on. And I recognized there is much more to learn.

I speak with modest pride when I call out the resolve by the Vertican team. I’m equally impressed when I look at the size of the data and our network, no client data was breached, and we were able to propagate the network efficiently.

Summer 2020, I wrote an article called A Little Bit of Luck, where I recapped a conversation by happenstance, which led me to Petra Consulting and ultimately Vertican on a new course of scaling forward.

However, it was anything but luck in Vertican’s ability to manage through a potentially catastrophic crisis. We were systematically prepared thanks to our operational DNA. Our leadership team functioned with unity, taking charge of different aspects of the company. No, I was not prepared for a 2:00 a.m. phone call. But the phases that followed, yes Vertican was prepared because we have been financially, technologically, and operationally investing in ourselves for years.

From an exploitation of a vulnerability in an esoteric part of the way files move through the internet, to a monumental, all hands on deck undertaking, Vertican teams were not only professionally ready, but they were also calm, resolute, and positive through it all.

Vertican has been bringing value and visionary innovation to the industry for the past 40 years. This cyberattack event has been a defining moment and launch pad to become an even better Vertican. Yet, there are a few things that will never change. We are a team of 84 people strong. We support hundreds of businesses, over 10k end users, and millions of consumers throughout the financial industry – from the largest banks and lenders in the world to mom-and-pop shops. We help clients with the ease of automated processes, data integrity, and reduction of costs – and we do so in a way in which we are tremendously proud.

On behalf of the Vertican team, I’d like to also take this opportunity to wish you and your families a joyful, peaceful, and healthy holiday season.