GadgetAccess Cyber Security Advisory
1800 928 982 Book a Diagnostic
Cyber incident case studyExecutive accountManufacturingNovember 20264 min read

Arrow Packaging Pty Limited

“We had antivirus protection. I thought we were protected.”

A Bitcoin ransom demand greeted CEO Manny Farr at login. With the tool room disrupted and the general ledger out of reach, the attack quickly became a business continuity problem.

By Manny Farr
Former CEO, Arrow Packaging · Now CFO, Gadget Access and CiBRAI

Follow the incident
Illustrative warehouse scene with a printer, a network cable and cardboard cartons.
01 / Warehouse printer Illustrative scene
$250,000

Approximate rectification cost to the insurer

~2 weeks

Disruption and specialist work

4

Specialists engaged by the insurer

01Incident timeline

From Manny’s account

A normal morning, until login.

When I arrived at Arrow Packaging, I expected a normal day. Instead, my screen warned that proceeding could erase our data. Within minutes, two colleagues told me they were seeing the same warning.

  1. 01At morning loginThe ransom demand appears

    Instead of gaining access, Manny saw a warning that company data could be erased and a demand for payment in Bitcoin.

  2. 02Within minutesTwo colleagues report the same warning

    The same warning appeared for two other employees arriving for work. What began at one workstation was already an issue for multiple staff.

  3. 03Immediate escalationManny stops logins and calls IT

    “Do not log into your computers. Do not touch anything.” Manny called the IT consultant, who investigated and advised the company that it had suffered a cyberattack.

  4. 04Over the next two weeksThe insurer brings in specialists

    Manny contacted the insurer under the company’s cyber cover. Four specialists investigated how access may have been gained and worked to rectify the damage.

02Suspected entry route

The connection investigators pointed to

The printer in the warehouse.

Manny was advised that a printer an employee had connected to a server may have provided a way into the company’s systems. The graphic shows the suspected route described in his account.

Suspected routeFrom the advice Manny received
  1. 01 / DeviceWarehouse printerAn everyday device on the network
  2. 02 / ConnectionServer linkThe connection described to Manny
  3. 03 / Potential reachBusiness systemsPossible access beyond the printer
The precise vulnerability and the steps taken by the attacker are unverified in the source account.

A question for your IT providerWhich printers and other devices can reach critical systems, and what limits that access?

03Business impact

Production, finance and insurance

When the business can’t run as usual.

The rectification bill effectively exhausted Arrow Packaging’s cyber insurance limit. The disruption also took up management time and made it harder to keep the business operating.

Illustrative wide view of a packaging tool room with workbenches, machinery and tool chests.
02 / Tool room Illustrative scene

Reported disruption

  • Tool room

    Could not operate normally.

  • General ledger

    Accounting records were inaccessible.

Potential exposure

Quality assurance records and employee, supplier and customer information were potentially at risk of compromise.

The antivirus myth

“If someone gets past our antivirus tomorrow morning, what is protecting the rest of our business?”

Manny Farr · Former CEO, Arrow Packaging

The business continuity playbook

Build a plan for the day a control fails.

Keep antivirus as one layer. Then put people and controls in place to spot an intrusion, limit its reach and get the business running again.

Four phases for a ransomware exercise

For leadership, operations and IT

  1. Prepare

    Inventory devices, including printers. Patch them, limit admin access and separate peripheral devices from critical systems.

  2. Detect

    Monitor security alerts and logs across devices, servers and networks. Give staff one clear way to raise an alarm.

  3. Contain

    Activate the response plan. Have responders isolate affected systems and preserve evidence. Contact the insurer early and check reporting obligations.

  4. Recover

    Once responders close the attacker’s access, restore priority services from verified clean backups. Have service owners confirm they work before restarting.

Keep protected backups and an offline copy of the plan. Rehearse who calls whom and time an actual restore.

Give finance and operations the same scenario.

It’s 8 am. The general ledger and tool room systems are unavailable. What happens next?

Finance
How will we verify payroll and supplier payments, track response costs and find our policy limit and insurer contact?
Operations
Which jobs can proceed safely? How will we record production and quality checks, and who decides when the tool room can restart?

Australian Signals Directorate guidance on the Ransomware Playbook, network segmentation and incident response plans for small businesses.

Put the question to your own business

What keeps your business running?

Start with one critical process. Ask who would spot a compromise, who could contain it and how you would prove you can restore the process in time.