Hackers drop their ransom price to $50m for huge cyber breach
The hackers who have claimed responsibility for an international ransomware outbreak have lowered their asking price in a private conversation with a cybersecurity expert, something he says may be a sign the group is having trouble monetising their massive breach.
The REvil ransomware gang, also known as Sodinokibi, is publicly demanding $US70 million ($A93 million) to restore the data it is holding ransom after their data-scrambling software affected hundreds of small and medium businesses across a dozen countries ā including schools in New Zealand and supermarkets in Sweden.
But in a conversation with Jack Cable of the cybersecurity-focused Krebs Stamos Group, one of the gangās affiliates said he could sell a āuniversal decryptorā for all the victims for $US50 million.
Cable told Reuters he managed to get through to the hackers after obtaining a cryptographic key needed to log on to the groupās payment portal.
Reuters was subsequently able to log on to the payment portal and chat with an operator who said the price was unchanged at $US70 million ābut we are always ready to negotiateā.
Because of REvilās affiliate structure, it is occasionally difficult to determine who speaks on the hackersā behalf but Cable said both conversations suggested that despite the headline $US70 million demand ātheyāre definitely not attached to that numberā.
You might like
āIt makes you wonder if theyāre having a hard time getting people to pay,ā he said.
Another expert said that the hackers, by encrypting so much data from so many businesses at once, may have bitten off more than they could chew.
āFor all of their big talk on their blog, I think this got way out of hand,ā said Allan Liska of cybersecurity firm Recorded Future.
The fallout of July 2 hack is still coming into focus.
Stay informed, daily
New Zealand officials said on Monday that 11 schools and several kindergartens were affected by the ransomware attack.
Kindergarten Association WhÄnau Manaaki, which has more than 100 member kindergartens, said it had been hit and had asked members to keep offline, Radio New Zealand reported.
Education Minister Chris Hipkins said the government was working to isolate any further risks.
In their conversation with Reuters, the hackersā representative described the disruption in New Zealand as an āaccidentā.
But they expressed no such regret about the disruption in Sweden, where hundreds of Coop supermarkets had to be closed because of the attack.
āIts nothing more than a business,ā the representative said when asked about the impact on grocery stores.
About a dozen different countries have been affected by the breach, according to research published by cybersecurity firm ESET.
On Sunday, the White House said it was reaching out to victims of the outbreak āto provide assistance based upon an assessment of national riskā.
Want to see more stories from InDaily Qld in your Google search results?
- Click here to set InDaily Qld as a preferred source.
- Tick the box next to "InDaily Qld". That's it.
