PLAINWELL, MI — A small radio station in Plainwell lost its entire music library to a ransomware attack two weekends ago and is still rebuilding its files after the virus encrypted its computer data.
WAKV AM 980 was attacked late in the afternoon of Jan. 9, says owner Jim Higgs.
"I came down into the studio and noticed that the station was silent," said Higgs, who operates the station out of his home. "I did a little investigating and found a message on my desktop computer saying that somebody had encrypted all of my files. It said, if I wanted them decrypted, I would have to pay $500."
Higgs deleted the message and knew he was in serious trouble.
The virus corrupted all of the station's audio files, so he lost not only all of the station's music but announcer voice tracks, jingles, promotional announcements and advertisements — as well as business records.
The station was off the air the night of Jan. 9 through mid-morning on Jan. 10. He was able to do the live Saturday morning show, but it was pretty rudimentary, he said.
"We had about six hours of instrumentals on Saturday, until I could figure out what to do," Higgs said.
It was an unfortunate lesson in the importance of backing up all of your computer files. Eventually, he was able to retrieve most of the music files from another computer, but most other audio files were lost as were the business records.
There were a couple of things that helped him. He had an old computer in the office, which had recently been replaced. He had meant to transfer many files from that to his new computer but never got around to it. That remained intact. Some of his new files were backed up on Carbonite — but in his computer upgrade he failed to add a new drive to the back-up service and all of that information was lost.
Higgs said the financial damage from the attack would be minimal, but it was going to be time-consuming to rebuild all of the files.
"Everything has to be redone," he said Friday. It could be weeks before things are back to normal, he said.
Higgs said he never reported the incident to the police because it didn't seem like it would do any good.
Unfortunately, he is correct, said Michigan State Trooper Rick Carlson, a digital evidence technician with the Paw Paw post of the state police.
"The problem with hacking or those types of things is they can come from any where in the world," Carlson said. "This ransomware, what we call malware, is similar to a virus. It's hard to say where you get it. The problem with most internet crime, is that we have to have at least a venue so we can reasonably prosecute these people."
Large-scale operations can sometimes be tracked but any investigation and prosecution would be handled by the FBI, Carlson said, because the crimes presumably cross state and sometimes international lines.
Carlson said the state police get pretty regular reports of these kinds of attacks.
The best tip he has for any business, Carlson said, is to back-up your files. "Most computers are going to fail at some point. Back ups are a necessity."
Next, people should be careful about the websites they visit, they should never open mystery emails or attachments, they should never respond to unusual inquiries claiming to be from their banks and they should never accept offers for computer repairs or services via the Internet.
"It's kind of buyer beware," Carlson said. "If it looks too good to be true or even if you get that sense of 'Why would this person be contacting me or offering me this service?' then that's something you have to beware of."
Higgs can't recall visiting any new websites or receiving unusual emails, but he knew one offer he wasn't about to take: the offer to pay to have his files unencrypted.
"With these things you're not dealing with reputable people," he said. "I had no assurance that even if I paid that my files would be any good. You don't know that if you send $500 you're going to get your files back the way they were. I was more inclined to try to rebuild the whole thing.
"People tell you all the time to back up everything. Until this kind of damage happens, you don't really appreciate that message. It's, 'Oh, yeah, I'll get around to it.' If it's really important to you, don't wait too long."
Linda S. Mah is a reporter for the Kalamazoo Gazette. Reach her at 269-303-6567 or her at lmah@mlive.com. You can follow her on Twitter.