LockBit Hit Us: A CISO's Real-World RANSOMWARE BREACH STORY | Zach Lewis

Zach Lewis, CIO and CISO at the University of Health Sciences and Pharmacy in St. Louis, breaks down the LockBit ransomware attack that hit his university in April 2023 and how it impacts CISOs and security leaders navigating the same threat today.◼ Incident response takeaway: why the first 24 hours matter more than any tool in your stack◼ Threat intelligence insight: how LockBit's negotiation tactics and "customer support" model actually work◼ Real-world application: the backup failure that nearly ended recovery, and the policy violation that saved it◼ Identity security lesson: how cached credentials let attackers escalate from one phished laptop to full domain control◼ Post-incident rebuild: the break-glass accounts, data governance, and password manager overhaul that followedZach walks through the full incident: discovering the ransom note on the hypervisor, the scramble to restore Active Directory on an esports gaming PC, refusing a $1.25M ransom demand, and the data governance and identity security overhaul that followed.(00:00) – Introducing Zach Lewis, University CISO(02:06) – Balancing CIO and CISO Roles(03:32) – Common Ransomware Misconceptions for Leaders(06:18) – Ransomware Industry Trends and Economics(07:44) – AI-Driven Phishing and Social Engineering(09:36) – Misdiagnosing a LockBit Cyberattack(10:30) – Ransom Note Found on Hypervisor(12:56) – First 24 Hours of Incident Response(15:20) – Impact on Students, Faculty, Systems(19:14) – Restoring Active Directory on Gaming Hardware(21:59) – LockBit Negotiation via Tor Network(24:50) – Backup Failures and Recovery Breakthrough(27:41) – Decision to Refuse Ransom Payment(34:20) – Root Cause: Phishing and Cached Credentials(41:38) – Why Only Partial Data Leaked(49:39) – Post-Incident Security Program Overhaul(1:04:45) – Final Advice for Security LeadersGuest ⬇️Zach Lewis: https://www.linkedin.com/in/zacharylewis1/Hosts ⬇️Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/Powered by Control D