Email marketing is particularly vulnerable to ransomware attacks and, to make matters worse, it is one of the few IT problems where tabloid journalism has got the fear factor just about right. It is scary.

The process behind ransomware is simple enough. A bit of software encrypts files on local and often networked computers. The victim is required to pay money, normally in Bitcoin, for a key to enable the infected files to be accessed. There are variations on this main theme, all of which are equally scary.

Our email marketing lists and other data makes us targets, not least because to admit to the attack might well leave us open to prosecution. Infection normally enters systems via an infected email attachment, although remote access is another way. It can be seen that weak security or poor systems can make things easy for the perpetuator.

First the good news. The norm is that the key is released after payment if you are hit by one of the habitual offenders. Like most parasites, they see no point in harming the host. Amateurs might take a different attitude. 

Recipients are encouraged to open the infected attachments by the use of words familiar to us in email marketing. ‘Act Now’ and similarly forceful phrases abound. All it needs is just one click.

Despite us having a considerable amount of data, not only our email marketing lists, there are a number of simple and inexpensive steps you can take to all but eliminate the threat. These include:

1/ Train staff.

Having an informed and motivated staff is the best defence against attack. If no one clicks on an attachment, the simplest method of infection is removed. 

2/ Check user accounts

Regularly check the access list. If people move post or leave entirely have systems to ensure their account is deleted. If a particular person has not accessed their account in a long time, then ask them to justify their access level. 

3/ Delete all unnecessary software.

This will restrict access points for the malware. As an added bonus, it will declutter your systems and probably decrease response times.

4/ Update everything.

Have systems whereby all software, particularly your anti-virus protection, is updated at the earliest opportunity. This reduces vulnerability.

5/ Back up

All your data is essential to you, or why else would it be cluttering your memory. Have regular back ups to both on- and offsite systems. Keep them offline as much as possible to ensure that they will not be infected. 

6/ Malware protection

Your IT protection systems should alert you to any unusual activity. An early warning can limit damage.

7/ Preparation

Have systems established so that if the worst happens or someone suspects that an attack might be underway, everyone knows what to do.

The ICO produces excellent information and ebooklet which give advice on how to defend against ransomware attacks. Your staff should be made aware of their content.

There is no reassuring Crimewatch postscript. Ransomware is a major threat to us all. You can, and should, reduce your vulnerability to such attacks. 

ICO ebook: Guide to IT security – https://ico.org.uk/media/for-organisations/documents/1575/it_security_practical_guide.pdf

ICO Blog: https://iconewsblog.wordpress.com/2016/12/15/being-held-to-ransom/