{"id":35553,"date":"2026-11-05T18:27:44","date_gmt":"2026-11-05T23:27:44","guid":{"rendered":"http:\/\/www.allyngibson.com\/?p=35553"},"modified":"2026-11-05T18:27:44","modified_gmt":"2026-11-05T23:27:44","slug":"the-ransomware-anniversary","status":"publish","type":"post","link":"http:\/\/www.allyngibson.com\/?p=35553","title":{"rendered":"The Ransomware Anniversary"},"content":{"rendered":"\n

Five years ago today, Diamond Comic Distributors was struck by ransomware. Hackers associated with the Conti group infiltrated Diamond’s system and brought it down for almost a month.<\/p>\n\n\n

\n
\"Photograph
The Conti ransom note. I have no idea what they asked for.<\/figcaption><\/figure>\n<\/div>\n\n\n

November 5th was a Friday. On Wednesday, we sent PREVIEWS<\/b><\/i> #399 to press. On Thursday, we sent the US order forms to press. On Friday…<\/p>\n\n\n\n

I arrived at the office to work on the UK order form. I expected an email from our UK team, I would perform Excel and Word alchemy, I would send Casey some files, and I’d call it a day in the early afternoon when everything was done.<\/p>\n\n\n\n

Diamond went remote in March 2020, and despite an RTO mandate in late 2020, it remained remote. I worked more of a hybrid schedule; working days in the office when I needed office resources (like the printers), performing delicate tasks that I didn’t trust to a remote connection, or just a change of scenery. The weeks when the catalog closed and everything went to press, I’d be in the office five days, occasionally four (sometimes working remotely on Monday).<\/p>\n\n\n\n

Stepping off the elevator on Friday, I was greeted by a handwritten sign: “Computers are down until further notice.” I left a box of dounts in Graphics — it was National Donut Day, and I knew there would be a few people in the office, even on a Friday — and went to my office. Someone, probably IT, knowing that I was a frequent office user, left a note on my computer telling me not to touch it, and I didn’t. I turned on my monitor, looked at my Windows lock screen wallpaper (an image of the interior of the Natioal Cathedral), and tried to occupy myself while I wanted.<\/p>\n\n\n

\n
\"Photograph
This was one hell of away to spend National Donut Day. I even brought a box of donuts<\/a> for the dozen or so people who were in the office that day.<\/figcaption><\/figure>\n<\/div>\n\n\n

I Marie Kondo-ed my office.<\/p>\n\n\n\n

I threw out old paperwork and junk.
\nI organized my desk.
\nI cleaned out the desk drawers.
\nI built an off-brand LEGO set of the space shuttle<\/a>.<\/p>\n\n\n

\n
\"LEGO-like
The space shuttle, mid-assembly. One of the cleaning crew at Diamond would break it a few years later.<\/figcaption><\/figure>\n<\/div>\n\n\n

It was still only about noon.<\/p>\n\n\n\n

Cindy Anderson, Diamond’s production manager, was also in the office that day. She too was cleaning out her office, and she stopped by my office to show me Quebecor invoices from 2001 that she had held onto through three, maybe even four, different buildings.<\/p>\n\n\n\n

“The computers,” she said. “I bet it’s ransomware.”<\/p>\n\n\n\n

“Well, that would suck,” I said.<\/p>\n\n\n\n

By 12:30 I said to myself, “This day is done.” The UK order form, which was no longer printed, just a PDF, could could wait until Monday. I left, went to Baja Fresh for lunch, and headed home.<\/p>\n\n\n\n

We had a Teams call in Marketing on Tuesday, and that was when we learned that, yes, it was ransomware and top people were looking into it. Top… people.<\/p>\n\n\n\n

On the PREVIEWS<\/b><\/i> team, some of us started talking about how we would do PREVIEWS<\/b><\/i> #400 without any of our tools–no PID, no InDesign templates, nothing.<\/p>\n\n\n\n

I was going to need a tool.<\/p>\n\n\n\n

Specifically, I was going to need a tool that would take an unstructured and raw Microsoft Word document and structure it in a way that an InDesign template would read and understand. (PID, the usual PREVIEWS<\/b><\/i> tool, did this automatically. We needed something for the case where it would not be automatic.) Elena developed new InDesign templates, we hashed out the style names she would use, and I began coding a Microsoft Word macro.<\/p>\n\n\n\n

The good thing was we had the quarterly week break between catalogs, so I had time. I also had some of the raw Word documents that PID produced at home. All I had to do was to take one of those Word documents and structure it with Styles.<\/p>\n\n\n\n

The macro is dated November 14th, nine days after the ransomware attack, though it developed over several days.<\/p>\n\n\n\n

It is not elegant. My comments in the VBA call it a “sledgehammer.” After it was run, to the naked eye, it appeared that nothing had changed; the text on the screen appeared to be exactly as it had been. But under the hood, the Word document had structure<\/i>.<\/p>\n\n\n\n

We hit the publishing deadline on PREVIEWS<\/b><\/i> #400. No remote access, just a backup network in the office that was walled off from the infected servers and the tools that Elena and I built separately to get it done.<\/p>\n\n\n\n

Oh, and I had COVID. Despite every precaution I took, I picked it up at the Maryland Irish Festival. The over symptoms were mild, just loss of taste and smell for a day, but the fatigue after lasted until late spring.<\/p>\n\n\n

\n
\"A
The Maryland Irish Festival, 2021. I went back and forth all day about going, even said to myself, “I am going to get COVID if I go. I was masked, most people weren’t, and the only time I had the mask off was when I sat in a corner by myself and ate a pit beef sandwich. I bought P.D. St. Claire’s novel Swampoodle<\/em><\/a>, and despite starting it, as some COVID brain fog developed I set it aside. I really should return to it.<\/figcaption><\/figure>\n<\/div>\n\n\n

There was a problem. I worked the problem. The tools I built I applied to other projects, like the PREVIEWS<\/b><\/i> UK Supplement, until my end with Diamond four years later.<\/p>\n\n\n\n

I never felt like I’d done anything special. I did what I needed to do.<\/p>\n\n\n\n

People have asked me in interviews how I dealt with a crisis at work. This is the story I tell.<\/p>\n","protected":false},"excerpt":{"rendered":"

Five years ago today, Diamond Comic Distributors was struck by ransomware. Hackers associated with the Conti group infiltrated Diamond’s system and brought it down for almost a month. November 5th was a Friday. On Wednesday, we sent PREVIEWS #399 to press. On Thursday, we sent the US order forms to press. On Friday… I arrivedContinue reading “The Ransomware Anniversary”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[229],"tags":[4846,426,5452,5503],"class_list":["post-35553","post","type-post","status-publish","format-standard","hentry","category-work","tag-diamond-comic-distributors","tag-microsoft-word","tag-previews","tag-ransomware","entry"],"_links":{"self":[{"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=\/wp\/v2\/posts\/35553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=35553"}],"version-history":[{"count":0,"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=\/wp\/v2\/posts\/35553\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=35553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=35553"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.allyngibson.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=35553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}