Travelex has confirmed that a major cyberattack that took its business offline last week was caused by ransomware.
The foreign exchange giant has revealed it was hit by the notorious Sodinikibi ransomware in an attack on New Year's Eve, with the criminals behind the attack demanding a $6m payment to restore stolen files.
Travelex was forced to take down its websites in 30 countries in an attempt to try and control the attack, with customers across Europe, Asia and the US still unable to gain online access to their accounts.
- Ransomware remains a huge threat to businesses
- Best free anti-ransomware software tools of 2020
- Over a thousand schools hit by ransomware in 2019
Ransom
The group behind the attack, known as REvil, claim to have gained access to Travelex's network six months ago.
REvil says it has a 5GB stash of downloaded information from the company, including customer dates of birth, credit card information and national insurance numbers.
"In the case of payment, we will delete and will not use that (data)base and restore them the entire network," the group said in a statement.
"The deadline for doubling the payment is two days. Then another seven days and the sale of the entire base."
Travelex may be set to face further punishment after the ICO revealed it had not received a data breach notice from the company. Under GDPR legislation, organisations must notify the ICO within 72 hours - unless the breach is deemed not to pose a risk to people's rights and freedoms.
Failure to comply could cost Travelex millions in fines, with the ICO able to issue a fine of four percent of an offender's global turnover.
"If an organisation decides that a breach doesn't need to be reported, they should keep their own record of it and be able to explain why it wasn't reported if necessary," the ICO added.
Travelex says it is working with the Metropolitan Police alongside its own teams of IT specialists and external cyber-security experts to investigate the attack.
"On Thursday, 2 January, the Met's Cyber Crime Team were contacted with regards to a reported ransomware attack involving a foreign currency exchange," the Met said in a statement. "Inquiries into the circumstances are ongoing."
- Stay safe online with the best antivirus software for 2020
Via BBC
