REvil Ransomware Attack: Coop, Other Affected Firms Could Take Weeks to Recover

REvil hackers compromised systems of IT firm Kaseya and malware trickled down to its resellers.

By Reuters | Updated: 6 July 2021 10:38 IST

REvil Ransomware Attack: Coop, Other Affected Firms Could Take Weeks to Recover

Hundreds of Coop grocery stores were shuttered after ransomware attack compromised its computer systems

Highlights

The ransomware locked data in encrypted files
The REvil actors had claimed that a million machines were compromised
Many Coop stores remained closed on Monday

Computer systems of several companies across the world, including 800 physical grocery stores of Sweden's Coop, that were shut down after attacked by REvil ransomware could take weeks to recover, cyber security experts said.

Hackers from the REvil cybercrime gang compromised systems of IT firm Kaseya and malware trickled down to its resellers and reached end customers such as Coop who used its software.

The ransomware locked data in encrypted files and late on Sunday hackers demanded $70 million (roughly Rs. 520 crores) to restore the data.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

The REvil actors had claimed that a million machines were compromised, said Mark Loman, director of engineering at cybersecurity firm Sophos.

"Depending on how big your business is and if you have backups, it can take weeks before you have restored everything, and as the supermarkets in Sweden have been impacted, they can lose a lot of food and revenue," he said.

Coop's grocery store chain had to close hundreds of stores on Saturday because its cash registers are run by Visma Esscom, which manages servers for a number of Swedish businesses and in turn uses Kaseya.

White House Says Reaching Out With Assistance to Latest Ransomware Victims

"We have stopped the attack and we are now restarting our systems," a Coop spokesperson said.

"We are recovering the systems and have now technicians who are visiting all of the affected stores to recover the data systems," they added.

Visma Esscom did not respond to requests for comment.

While many Coop stores remained closed on Monday, some stores have opened their doors and were allowing customers to pay by using an app called "Scan and Pay."

"I don't think we have seen anything this large scale before," said Anders Nilsson, chief technology officer at ESET Nordics. "This is the first time we are seeing a grocery not been able to process payments and this shows how vulnerable we are."

To fix the issues, Coop's payment provider needs to physically go to all stores and restore payment machines manually from backups.

As is routine, the hackers created a channel for negotiating with the victims of the ransomware attack.

Speaking in this online chatroom, which Reuters was able to access, a representative for a REvil affiliate said the hackers had no regrets about forcing Coop to close.

"It's nothing more than a business," the representative told Reuters when asked about the impact of shutting supermarkets in Sweden.

The representative said that while the gang was seeking $70 million (roughly Rs. 520 crores) to restore all the data from all the victims, "we are always ready to negotiate."

ESET's Nilsson said, "It doesn't really matter if they pay or not, they are still going to take time to restore all the machines."

Colonial Pipeline faced an extortion attack earlier this year, causing a shutdown lasting several days. The company paid the hackers nearly $5 million (roughly Rs. 37 crores) to regain access.

"Paying a ransom is just putting the fire out but it will not make your environment more secure," said David Jacoby, deputy director at Kaspersky.

"The companies should not pay the ransom, because we don't want to encourage cyber criminals that this is something that's profitable."

Interested in cryptocurrency? We discuss all things crypto with WazirX CEO Nischal Shetty and WeekendInvesting founder Alok Jain on Orbital, the Gadgets 360 podcast. Orbital is available on Apple Podcasts, Google Podcasts, Spotify, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.