'Stark wakeup call': Cyberattack on Hilltop Bank highlights growing online threats

CASPER, Wyo. –– Cybersecurity expert Laura Baker had two immediate thoughts when she first heard Hilltop Bank had been temporarily shut down after an apparent cyberattack. Baker is the founder and executive director of the nonprofit CyberWyoming , which helps local small and micro business owners deal with cybersecurity. Naturally, her first thought went to the many small businesses who do their banking at Hilltop. “They have all their funds at Hilltop Bank and are probably completely stressed out right now, which is really unfortunate,” she said. The thought was the reality of a bank being affected by an attack of this scope. “This is a stark wake-up call, because banks have cybersecurity down in Wyoming,” she said. “They get audited more than anybody else, and if it can happen to Hilltop, it can happen to anybody, which is pretty disturbing.” When a bank goes down, there are serious risks for small businesses operating on slim profit margins being able to cover expenses, make payroll or serve their customers. Such an incident could range from being a time-consuming nuisance to a potentially devastating event. It rattled Baker enough that she went over CyberWyoming’s own incident playbook early Thursday morning. “I looked at our section that said, ‘What if my bank goes down?’ and I realized that we’re [potentially] at risk too because all of our funds are in one bank,” she said. The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft. “I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

Baker is the founder and executive director of the nonprofit CyberWyoming , which helps local small and micro business owners deal with cybersecurity. Naturally, her first thought went to the many small businesses who do their banking at Hilltop. “They have all their funds at Hilltop Bank and are probably completely stressed out right now, which is really unfortunate,” she said. The thought was the reality of a bank being affected by an attack of this scope. “This is a stark wake-up call, because banks have cybersecurity down in Wyoming,” she said. “They get audited more than anybody else, and if it can happen to Hilltop, it can happen to anybody, which is pretty disturbing.” When a bank goes down, there are serious risks for small businesses operating on slim profit margins being able to cover expenses, make payroll or serve their customers. Such an incident could range from being a time-consuming nuisance to a potentially devastating event. It rattled Baker enough that she went over CyberWyoming’s own incident playbook early Thursday morning. “I looked at our section that said, ‘What if my bank goes down?’ and I realized that we’re [potentially] at risk too because all of our funds are in one bank,” she said. The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft. “I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

The thought was the reality of a bank being affected by an attack of this scope. “This is a stark wake-up call, because banks have cybersecurity down in Wyoming,” she said. “They get audited more than anybody else, and if it can happen to Hilltop, it can happen to anybody, which is pretty disturbing.” When a bank goes down, there are serious risks for small businesses operating on slim profit margins being able to cover expenses, make payroll or serve their customers. Such an incident could range from being a time-consuming nuisance to a potentially devastating event. It rattled Baker enough that she went over CyberWyoming’s own incident playbook early Thursday morning. “I looked at our section that said, ‘What if my bank goes down?’ and I realized that we’re [potentially] at risk too because all of our funds are in one bank,” she said. The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft. “I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

When a bank goes down, there are serious risks for small businesses operating on slim profit margins being able to cover expenses, make payroll or serve their customers. Such an incident could range from being a time-consuming nuisance to a potentially devastating event. It rattled Baker enough that she went over CyberWyoming’s own incident playbook early Thursday morning. “I looked at our section that said, ‘What if my bank goes down?’ and I realized that we’re [potentially] at risk too because all of our funds are in one bank,” she said. The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft. “I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

It rattled Baker enough that she went over CyberWyoming’s own incident playbook early Thursday morning. “I looked at our section that said, ‘What if my bank goes down?’ and I realized that we’re [potentially] at risk too because all of our funds are in one bank,” she said. The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft. “I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

The incident has encouraged her to open a second account in a different bank, where she’ll store a month’s worth of expenses and payroll as a safety backup. She recommends backups for all online accounts and services that small businesses rely on, even those using seemingly impermeable services such as Google or Microsoft.

“I think the big part of this is, don’t put all your eggs in one basket,” she said. “Don’t put them all in QuickBooks, don’t put them all in Google, don’t put them all in one bank. If it’s a critical system, make sure you have an alternative plan.” She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

She even goes so far as to recommend backup domain names for small online businesses, just in case the main one gets hijacked at some point. “Make sure your backups are offsite,” she said. “If you do that, then you know that you’re only going to be down for a short period of time and your customers would understand.” Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix. “One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

Assets in the hands of cybercriminals are becoming exponentially more sophisticated, especially with artificial intelligence in the mix.

“One person can’t keep up with this anymore, it’s going so fast,” she said. “It used to be that 90% of breaches happened with phishing scams, but now we read reports that it’s closer to 60% because of AI.” A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

A case like Hilltop Bank, which is among the largest and most established independent banks in Wyoming, isn’t unheard of. Sawyer Savings Bank, a 150-year-old East Coast institution, was temporarily crippled by a major cyberattack in August which regulators said was caused by a cyberattack involving a vendor vulnerability . As of Thursday, Hilltop Bank had restored some banking services after closing all branches and banking activities on Wednesday due to what they’re describing as a “cybersecurity incident.” They say that no customer assets or data were breached. Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.” August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

Past cyberattacks in Wyoming have carried far more risk than just finances. A September 2019 ransomware attack on the Campbell County Health hospital in Gillette led the county to adopt a resolution declaring a disaster . “All computers in the hospital are shut off at this point,” said Steve Crichton, CCH vice president of facilities during the event. “We are unable to admit additional patients to the hospital. The ER and walk-in clinics are making decisions on a case-by-case basis.”

August also saw water systems in several municipalities attacked by cybercriminals , and many experts are voicing concerns vulnerabilities in power grids . For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related

For the Hilltop Bank case, Baker urges customers to be patient and understanding. “It doesn’t mean somebody messed up at Hilltop, I want to make that clear,” she said. “It could be a zero-day vulnerability that nobody knew and AI uncovered, so it’s really important that we give their IT team a little bit of grace because they’re working 24/7. They’re exhausted, they’re stressed out.” Related