A South Korean hosting company has paid what is believed to be a record high payment after their servers were taken over by ransomware.

The attack, which targeted the Internet company Nayana Inc., saw 153 Linux servers at the company hosting 3,400 websites taken over and controlled on June 10. A variant of the Erebus ransomware, which targets Linux computers, was used in the attack.

The ransomware managed to bypass the User Account Control feature to launch itself with higher privileges. Once it had access to a targeted machine, it used RSA-2048 encryption to encrypt targeted files, appending .ecrypt to the end of those files while simultaneously leaving a ransom demand.

According to reports Tuesday, the hackers initially requested a ransom payment of 500 bitcoin, equivalent to $1.62 million in order to decrypt the affected files from all its servers. Perhaps knowing their demand was on the high side, they negotiated with Nayana to bring the final payment down to 397.6 BTC ($1 million) to be paid in installments. As of Saturday, the company had already paid two of the three installments and is expected to make the final payment once full control of all its servers is returned.

Although the attack and payment of the ransom is unfortunate, Nayana would appear to have left itself open to the attack by running old versions of software. TrendMicro noted that the company’s website was running “on Linux kernel 2.6.24.2, which was compiled back in 2008,” and that it was also using Apache version 1.3.36 and PHP version 5.1.4, “both of which were released back in 2006” and have known vulnerabilities and exploits.

“Given the risks to business operations, reputation, and bottom line, enterprises need to be proactive in keeping threats like ransomware at bay,” the TrendMicro researcher added. “There is no silver bullet to ransomware like Erebus, which is why IT/system administrators should have a defense-in-depth approach to security.”

Best practices, the company said, include a laundry list of perhaps obvious measures, among them backing up critical files, minimizing third-party or unverified repositories, ensuring servers are updated, regularly monitoring the network and inspecting event logs.

Image: sheila_sund/Flickr