The Jerusalem Post

‘Hackers demand $70m. for data’

- • By RAPHAEL SATTER

WASHINGTON (Reuters) – Hackers suspected to be behind a mass extortion attack that affected hundreds of companies worldwide late on Sunday demanded $70 million to restore the data they are holding ransom, according to a posting on a dark website.

The demand was posted on a blog typically used by the REvil gang, a Russia-linked group that is counted among the cybercrimi­nal world’s most prolific extortioni­sts.

The gang has an affiliate structure, making it difficult to determine who speaks on the hackers’ behalf, but Allan Liska of cybersecur­ity firm Recorded Future said the message “almost certainly” came from REvil’s core leadership.

The group has not responded to an attempt by Reuters to reach it for comment.

REvil’s ransomware attack, which the group executed on Friday, was among the most dramatic in a series of increasing­ly attention-grabbing hacks.

The gang broke into Kaseya, a Miami-based informatio­n tech firm, and used their access to breach some of its clients’ clients, setting off a chain reaction that paralyzed the computers of hundreds of firms worldwide.

An executive at Kaseya said the company was aware of the ransom demand but did not immediatel­y return further messages seeking comment.

About a dozen different countries were affected, according to research published by cybersecur­ity firm ESET.

In at least one case, the disruption spilled out into the public domain when the Swedish Coop supermarke­t chain had to close hundreds of stores on Saturday because its cash registers had been knocked off-line as a consequenc­e of the attack.

Earlier on Sunday, the White House said it was reaching out to victims of the outbreak “to provide assistance based upon an assessment of national risk.”

The impact of the intrusion is still coming into focus.

Those hit included schools, small public-sector bodies, travel and leisure organizati­ons, credit unions and accountant­s, said Ross McKerchar, chief informatio­n security officer at Sophos Group Plc.

McKerchar’s company was one of several that had blamed REvil, but Sunday’s statement was the group’s first public acknowledg­ment that it was behind the campaign.

Ransom-seeking hackers have tended to favor more focused shakedowns against single, high-value targets like Brazilian meat-packer JBS, whose production was disrupted last month when REvil attacked its systems. JBS said it ended up paying the hackers $11m.

Liska said he believed the hackers had bitten off more than they could chew by scrambling the data of hundreds of companies at a time and that the $70m. demand was an effort to make the best of an awkward situation.

“For all of their big talk on their blog, I think this got way out of hand,” he said.

Newspapers in English

Newspapers from Israel