LONDON (Reuters) - U.S. travel management firm CWT paid $4.5 million this week to hackers who stole reams of sensitive corporate files and said they had knocked 30,000 computers offline, according to a record of the ransom negotiations seen by Reuters.
Part of the payment negotiations between ransom -seeking cybercriminals - marked "Support" - and a representative of travel giant CWT - marked "You" is seen in this photo taken in Washington, D.C., U.S., July 30, 2020. REUTERS/Raphael Satter
The attackers used a strain of ransomware called Ragnar Locker, which encrypts computer files and renders them unusable until the victim pays for access to be restored.
The ensuing negotiations between the hackers and a CWT representative remained publicly accessible in an online chat group, providing a rare insight into the fraught relationship between cyber criminals and their corporate victims.
CWT, which posted revenues of $1.5 billion last year and says it represents more than a third of companies on the S&P 500 U.S. stock index, confirmed the attack but declined to comment on the details of what it said was an ongoing investigation.
“We can confirm that after temporarily shutting down our systems as a precautionary measure, our systems are back online and the incident has now ceased,” it said in a statement.
“While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised.”
CWT said it had immediately informed U.S. law enforcement and European data protection authorities.
A person familiar with the investigation said the company believed the number of infected computers was considerably less than the 30,000 the hackers told CWT they had infected.
DIGITAL RANSOM NOTE
Th ..
Support the originator by clicking the read the rest link below.
