Clop Ransomware Gang Extorts Household Names including BBC, British Airways and Boots

This week, it was discovered that cybercriminals had exploited an ongoing vulnerability in Progress Software’s MOVEit file transfer app to infiltrate the systems of payroll company, Zellis. According to its website, 42% of the FTSE 100 are Zellis customers and over £28bn is paid each year through its Managed Services.

This eventually led to a widespread ransomware attack impacting at least eight customers including the BBC, British Airways, Aer Lingus and Boots; all of whom have been given an ultimatum to begin ransom negotiations before the 14^th of June or see hundreds of thousands of their employees’ data published online. Data stolen comprises of national insurance numbers, home addresses and even bank details.

Russian ransomware gang, Clop, have taken responsibility for the attack and have suggested that they have information on hundreds of companies.

Commenting on the news, Simon Newman, Advisory Council member of International Cyber Expo said:

“Many larger organisations have invested heavily in boosting their own cyber security over the past few years, making it more difficult for cyber-criminals to find a way in. As a result, cyber criminals are increasingly shifting their focus onto supply chains which are often long and complex.

The ability to compromise the security of a supplier not only provides a potential back door into larger organisations, but as the third party is likely to provide products or services to other companies as well, it means that the scale and the scope of the attack is far greater.

Despite this, according to the Cyber Breaches Survey 2023, only 13% of businesses regularly review the risks posed by their immediate suppliers. The National Cyber Security Centre (NCSC) recently published new guidance on supply chain security to improve awareness and promote the adoption of good practice.”

Ray Kelly, Fellow at Synopsys Software Integrity Group added:

“This is a significant breach that demonstrates the importance of the software supply chain when it comes to data privacy. In this incident, a single vulnerability in a piece of software run by a third-party vendor led to the compromise and exposure of personal employee data across multiple organisations that the vendor services. The depth of this breach is still being investigated, but it will be interesting to see how GDPR will assess fines for the various organisations involved in this incident, as the software supply chain aspect certainly complicates matters.”

For Javvad Malik, lead security awareness advocate at KnowBe4, the attack is a “grim reminder of the sheer value of data in the hands of malicious actors. Cybercriminals know organisations cannot afford to lose critical data, causing undue pressure to pay large ransoms. This once again highlights the crushing effect of data breaches on modern organisations; a fact that hackers are acutely aware of.”

And therefore, he advises organisations to “implement robust security measures that include multi-layered cybersecurity defences, employee cybersecurity awareness training, and a tested incident response plan. The key message remains clear, we must prioritise our data and adequately invest in its protection.”

Moreover, Newman cautions the affected companies against paying the ransoms, concluding:

“Paying ransoms to cyber criminals does not guarantee that all the data will be returned. In fact, in most cases, it’s extremely rare and may simply expose you to further ransomware attacks in the future.”

In a similar vein, Etay Maor, Senior Director of Security Strategy at Cato Networks shares:

“Paying a ransom isn’t just about the money. It’s about suspension of business, loss of reputation if the attack becomes public knowledge, and more – how do you hammer the message home to those at risk?

Unfortunately, I think this message is being hammered with every report of ransomware attack. Paying a ransom doesn’t guarantee that the data won’t be published. Ultimately, it ends up showing other ransomware groups that this organisation will falter if attacked and pay up. What’s more, some ransomware groups are known to be a part of, or work on behalf of nation state actors. This means that the government forbids paying these groups due to sanctions. As a result, any businesses found to have paid ransom to sanctioned groups may also be investigated for doing so.

Businesses know today that such an attack can result in significant downtime for the business, a regulatory and compliance nightmare and reputation problem. However, paying the ransom will not solve the problem, only further exacerbate the issue and potentially cause cyber insurance premium hikes in the long run.”