UK rail network Merseyrail has confirmed a cyberattack after a ransomware gang used their email system to email employees and journalists about the attack.
Merseyrail is a UK rail network that provides train service through sixty-eight stations in the Liverpool City Region in England.
"We can confirm that Merseyrail was recently subject to a cyber-attack. A full investigation has been launched and is continuing. In the meantime, we have notified the relevant authorities," Merseyrail told BleepingComputer yesterday after we received a mysterious email earlier this month from the account of Andy Heath, the Director of Merseyrail.
Ransomware gang uses Merseyrail's email system against them
While the cyberattack has not been publicly disclosed, BleepingComputer learned of the attack after receiving a strange email on April 18th from Heith's email account with the mail subject, "Lockbit Ransomware Attack and Data Theft."
This email was sent to BleepingComputer, various UK newspapers, and the staff of Merseyrail in what appears to be a takeover of the Director's @merseyrail.org Office 365 email account by the Lockbit Ransomware gang.
In this email, the threat actors pretended to be Merseyrail's Director telling employees that a previous weekend's outage was downplayed and that they suffered a ransomware attack where the hackers stole employee and customer data.
Included in the email is a link to an image showing an employee's personal information that Lockbit allegedly stole during the attack.
After numerous attempts to contact Merseryrail and confirm the attack, we finally received the rail network's statement last night.
"It would be inappropriate for us to comment further while the investigation is underway," Merseyrail told BleepingComputer when we questioned how the Director's email was compromised.
In response to ..
Support the originator by clicking the read the rest link below.
