The attackers who leaked sensitive information on Lady Gaga last week after breaking into systems belonging to a law firm with a long list of celebrity clients, are now threatening to do the same with data from food supplier Sherwood Food Distributors.
According to security vendor DarkOwl, data posted on a Tor hidden service called the Happy Blog shows that the operators of the REvil (aka Sodinokibi) ransomware family are holding Sherwood to ransom by stealing critical data from the company and threatening to disclose it publicly.
DarkOwl said its analysis shows the attackers have managed to steal some 2,600 files from Sherwood. The stolen data includes cash-flow analysis, distributor data, business insurance content, and vendor information. Included in the dataset are scanned images of driver's licenses of people in Sherwood's distribution network.
The threat actors posted screen shots of a chat they had with Coveware, a ransomware mitigation firm that Sherwood had hired to help deal with the crisis. The conversation shows that Sherwood has been dealing with the attack since at least May 3rd , according to DarkOwl's research. The screenshots also suggest that Sherwood at one point was willing to pay $4.25 million and later $7.5 million to get its data back. Sherwood as of this posting had not responded to a Dark Reading inquiry.
Sherwood is the second company in recent days that the REvil group is believed to have compromised. On May 11, celebrity law firm Grubman Shire Meiselas & Sacks (GSM) announced that attackers had broken into its systems and was holding hostage 756GB o ..
Support the originator by clicking the read the rest link below.
