Hackers ask US firm to pay $70m after attack

Published July 6, 2021
Hackers were on Monday demanding $70 million in bitcoin in exchange for data stolen during an attack on a US IT company that has shuttered hundreds of Swedish supermarkets. — Reuters
Hackers were on Monday demanding $70 million in bitcoin in exchange for data stolen during an attack on a US IT company that has shuttered hundreds of Swedish supermarkets. — Reuters

PARIS: Hackers were on Monday demanding $70 million in bitcoin in exchange for data stolen during an attack on a US IT company that has shuttered hundreds of Swedish supermarkets.

Researchers believe more than 1,000 companies could have been affected by the attack on Miami-based firm Kaseya, which provides IT services to some 40,000 businesses around the world.

The FBI warned on Sunday that the scale of the “ransomware” attack — a form of digital hostage-taking where hackers encrypt victims’ data and then demand money for restored access — is so large that it may be “unable to respond to each victim individually”.

Sweden’s Coop supermarket chain was among the most high-profile victims.

Most of their 800 stores were still closed three days after the hack paralysed its cash registers, spokesman Kevin Bell said.

Coop, like many of the companies affected, is not a direct customer of Kaseya’s, but its IT subcontractor Visma Esscom was hit by the attack.

The few hundred Coop stores that had reopened were relying on alternative payment solutions, such as customers paying using their smartphones, Bell said.

Cybersecurity firm ESET said it had identified victims of the hack in at least 17 countries, from South Africa to Britain to Mexico. New Zealand’s education ministry said at least two schools there had been affected.

Experts believe the attack was probably carried out by REvil, a Russian-speaking hacking group known as a prolific perpetrator of ransomware attacks.

A post on Happy Blog, a site on the dark web previously associated with the group, claimed responsibility for the attack and said it had infected “more than a million systems”.

The FBI believes that REvil, which also goes by the name Sodinokibi, was behind a ransomware attack last month on global meat-processing giant JBS. The Brazil-based company ended up paying $11 million in bitcoin to the hackers.

The hackers’ blog post said they would release a decryption tool online “so everyone will be able to recover from attack in less than an hour” — if they were handed $70 million in bitcoin.

Kaseya said it believed the damage had been restricted to a “very small number” of customers using its signature VSA software, which lets companies manage networks of computers and printers from a single point.

But cybersecurity firm Huntress Labs said in a Reddit forum that it was working with partners targeted in the attack, and that the software was manipulated “to encrypt more than 1,000 companies”.

Kaseya said it had “immediately shut down” its servers after detecting the attack on Friday and warned its VSA customers to do the same, “to prevent them from being compromised”. The company has released a tool allowing its customers to find out whether their own computer systems have been compromised by the attack.

In recent months numerous US companies, including the computer group SolarWinds and the Colonial oil pipeline, have been the victims of high-profile ransomware attacks, which the FBI blames on hackers based in Russia.

While Washington officials do not accuse the Russian government of direct involvement in such attacks, they say the country is harbouring hackers who should be arrested.

Published in Dawn, July 6th, 2021

Opinion

A whiff of hope

A whiff of hope

Despite the old script that has played out in front of us, political events do indicate some changes.

Editorial

Updated 17 May, 2022

Buyer’s remorse

It is strange to hear senior PML-N leaders lamenting the subsidies, yet not even coming up with a subsidy rationalisation plan.
17 May, 2022

Sikh traders’ killing

THE brutal murder of two Sikh traders in the outskirts of Peshawar on Sunday illustrates the vulnerability of...
17 May, 2022

Cholera outbreak

REPORTS of rising cases of cholera and acute watery diarrhoea in several areas are raising the spectre of a public...
Updated 16 May, 2022

Electoral reforms

EARLY elections or not? That is the question. And it seems to be weighing heavy on the mind of everyone in the...
16 May, 2022

Iran deal revival

WHERE the nuclear deal between Iran and the P5+1 is concerned, a great deal of fluidity exists regarding its fate....
16 May, 2022

Deprived of funds

THIS May, Pakistan’s former Fata region will complete its fourth year of merger with Khyber Pakhtunkhwa. The...