Hackers demand $70 million to restore data held by companies hit in cyberattack

WASHINGTON, July 5 – Hackers suspected to be behind a mass extortion attack that affected hundreds of companies worldwide late on Sunday demanded $70 million to restore the data they are holding ransom, according to a posting on a dark website.

The demand was posted on a blog typically used by the REvil cybercrime gang, a Russia-linked group that is counted among the cybercriminal world’s most prolific extortionists.

The gang has an affiliate structure, occasionally making it difficult to determine who speaks on the hackers’ behalf, but Allan Liska of cybersecurity firm Recorded Future said the message “almost certainly” came from REvil’s core leadership.

REvil’s ransomware attack, which the group executed on Friday, was among the most dramatic in a series of increasingly attention-grabbing hacks.

The gang broke into Kaseya, a Miami-based information technology firm, and used their access to breach some of its clients’ clients, setting off a chain reaction that quickly paralyzed the computers of hundreds of firms worldwide.

An executive at Kaseya said the company was aware of the ransom demand but did not immediately return further messages seeking comment.

About a dozen different countries were affected, according to research published by cybersecurity firm ESET.

In at least one case, the disruption spilled out into the public domain when Swedish Coop grocery store chain had to close hundreds of stores on Saturday because its cash registers had been knocked offline as a consequence of the attack. 

Earlier on Sunday, the White House said it was reaching out to victims of the outbreak “to provide assistance based upon an assessment of national risk.” 

The impact of the intrusion is still coming into focus.

Those hit included schools, small public-sector bodies, travel and leisure organizations, credit unions, and accountants, said Ross McKerchar, the chief information security officer at Sophos Group Plc 

Source- Reuters