Push Admin

Massive ransomware attack potentially hit 1,000 businesses

Article (news)

Agence France-Presse

<p>SAN FRANCISCO, United States - A ransomware attack on a US IT company potentially targeted 1,000 businesses, researchers said Saturday, with one of Sweden&#x27;s biggest supermarket chains revealing it had to temporarily close around 800 stores after losing access to its checkouts.</p><p>Russian-based hackers have been blamed for a string of ransomware attacks, and US President Joe Biden recently raised the threat in talks with Russian counterpart Vladimir Putin.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/06/03/21/biden-says-looking-at-russia-retaliation-over-cyberattack">Biden says &#x27;looking&#x27; at Russia retaliation over cyberattack</a></li></ul><p>Biden ordered a full investigation on Saturday, while adding &quot;the initial thinking was it was not the Russian government, but we&#x27;re not sure yet.&quot;</p><p>&quot;I&#x27;ll know better tomorrow, and if it is either with the knowledge of and/or a consequence of Russia, then I told Putin we will respond,&quot; he said.</p><p>The IT company targeted, Kaseya, said Friday evening it had limited the attack to &quot;a very small percentage of our customers&quot; who use its signature VSA software -- &quot;currently estimated at fewer than 40 worldwide.&quot;</p><p>But cybersecurity firm Huntress Labs said in a Reddit forum that it was working with partners targeted in the attack, and that the software was manipulated &quot;to encrypt more than 1,000 companies.&quot;</p><p>Ransomware attacks typically involve locking away data in systems using encryption, making companies pay to regain access.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/05/28/21/us-steps-up-cybersecurity-pipeline-ransomware">US steps up cybersecurity requirements after pipeline hack</a></li></ul><p>Brett Callow, an analyst for cybersecurity company Emsisoft, said it remained unknown how many companies were affected and said the scale of attack could be &quot;without precedent.&quot;</p><p>Kaseya describes itself as a leading provider of IT and security management services to small and medium-sized businesses. VSA is designed to let companies manage networks of computers and printers from a single point.</p><p>&quot;One of our subcontractors was hit by a digital attack, and that&#x27;s why our checkouts aren&#x27;t working any more,&quot; Coop Sweden, which accounts for around 20 percent of the country&#x27;s supermarket sector, said in a statement.</p><p>&quot;We regret the situation and will do all we can to reopen swiftly,&quot; the cooperative added.</p><p>Coop Sweden did not name the subcontractor or reveal the hacking method used against it.</p><p>But the Swedish subsidiary of the Visma software group said the problem was linked to the Kaseya attack.</p><div><strong>- Immediate shutdown -</strong></div><p>Kaseya became aware of a possible incident with VSA at midday Friday on the US East Coast and &quot;immediately shut down&quot; its servers as a &quot;precautionary measure,&quot; it said.</p><p>It also &quot;notified our on-premises customers via email, in-product notes, and phone to shut down their VSA servers to prevent them from being compromised.&quot;</p><p>&quot;We believe that we have identified the source of the vulnerability and are preparing a patch to mitigate it,&quot; the company said in a statement.</p><p>According to the New Zealand government&#x27;s Computer Emergency Response Team, the attackers were from a hacking group known as REvil.</p><p>REvil was also, according to the FBI, behind last month&#x27;s attack on JBS, one of the world&#x27;s biggest meat processors, which ended with the Brazil-based company paying bitcoin worth $11 million to the hackers.</p><div><strong>- &#x27;Avoid paying&#x27; -</strong></div><p>The UN Security Council this week held its first formal public meeting on cybersecurity, addressing the growing threat of hacks to countries&#x27; key infrastructure.</p><p>Several Security Council members acknowledged the grave dangers posed by cybercrime, notably ransomware attacks on major installations and companies.</p><p>Multiple US companies, including the computer group SolarWinds and the Colonial oil pipeline, have also recently been targeted by ransomware attacks.</p><p>The FBI has blamed those attacks on hackers based in Russian territory.</p><p>But typically, &quot;cybercriminals operate company by company,&quot; said Gerome Billois, a cybersecurity expert with Wavestone consultancy.</p><p>&quot;In this case, they attacked a company that provides software for managing data systems, allowing them to simultaneously target several dozen -- possibly even hundreds -- of companies,&quot; he said. </p><p>Determining exactly how many is difficult, since affected companies lose their communications systems at the same time, Billois said. </p><p>And Kaseya, which had urged its clients to shut down servers running its VSA platform, cannot know whether systems were turned off &quot;voluntarily or by force.&quot;</p><p>&quot;This is one of the largest, most widespread ransomware attacks I&#x27;ve seen in my career,&quot; said Alfred Saikali of law firm Shook, Hardy &amp; Bacon.</p><p>&quot;I have never seen this many companies hire us in a single day for the same incident. As a general rule, you want to avoid paying the ransom at all costs.&quot; </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/spotlight/05/25/21/cyberattacks-bigger-smarter-us-pipeline">Cyberattacks: Bigger, smarter, faster</a></li></ul><div><strong>burs-jum-ft/bbk/bgs/leg</strong></div><div><strong>© Agence France-Presse</strong></div><div><strong>RELATED VIDEO</strong></div><figure class="op-interactive"><iframe height="315" src="https://www.youtube.com/embed/lyYT-nTUlH0?enablejsapi=1" width="560"></iframe></figure><div class="iwantbar">Watch more in <a href="//www.iwantv.com.ph/">iWantv</a> or <a href="//tfc.tv/">TFC.tv</a></div>

<p>SAN FRANCISCO, United States - A ransomware attack on a US IT company potentially targeted 1,000 businesses, researchers said Saturday, with one of Sweden's biggest supermarket chains revealing it had to temporarily close around 800 stores after losing access to its checkouts.</p>

SAN FRANCISCO, United States - A ransomware attack on a US IT company potentially targeted 1,000 businesses, researchers said Saturday, with one of Sweden's biggest supermarket chains revealing it had to temporarily close around 800 stores after losing access to its checkouts.