Morning at the plant: every screen shows a ransom note — production controls (SCADA), warehouse management and accounting all encrypted. Lines stand still, each hour costing hundreds of millions of dong. Ransomware is no longer just banks’ problem — manufacturers are favorite targets because they can’t stay down long.
1. First 24 hours: don’t pay the ransom hastily
Isolate infected systems from the LAN and internet to stop spread — but don’t power off servers prematurely if digital evidence (RAM, logs) must be preserved; don’t pay immediately: payment guarantees nothing, marks you as a "fat target" for next time, and may raise crime-financing issues in some contexts; activate contingency: manual operations, restore from clean backups (verified malware-free). In parallel, log everything: timeline, discovery time, attackers’ messages.
2. Reporting under the Cybersecurity Law 2018
The Cybersecurity Law 2018 (24/2018/QH14) requires organisations discovering cyberattacks to promptly notify the specialised cybersecurity force (the Department of Cybersecurity and Hi-Tech Crime Prevention — A05, Ministry of Public Security) and their managing authority. Malware distribution and unauthorised system intrusion may constitute offences under Articles 286 and 289 of the Penal Code 2015. Reporting serves investigation — and the police receipt record is vital evidence for insurance claims and explaining delivery delays to customers.
3. Cyber insurance: the new financial shield
Cyber insurance is growing in Vietnam, covering: incident-response costs (experts, restoration); business-interruption losses; legal and PR costs; and in some policies ransom payments (under strict conditions). Payout precondition: minimum security measures (firewalls, patching, backups) — buying insurance with "doors wide open" still means denial. Without cyber cover, property all-risks may cover some physical damage but typically excludes digital losses and cyber-driven interruption.
4. Prevention: cybersecurity is part of production safety
Segregate industrial control (OT) networks from office IT; patch regularly, including SCADA; keep offline backups of critical data and test restores; train staff against phishing (the gateway of most ransomware); rehearse incident response like fire drills. Attackers need one gap — defenders must close them all.
This article has been quality-reviewed by the FLAW AI Legal Council