ION Group paid ransom and claims hackers responsible for disruptive breach

Hackers who claimed responsibility for a disruptive breach at financial data firm ION said a ransom had been paid, although they declined to say how much it was or offer any evidence that the ransom had been paid. money had been returned.

ION Group declined to comment on the statement. On Friday, Lockbit communicated the claim to Reuters via its online chat account, but declined to say who had paid the money, saying it was from a “very wealthy unknown philanthropist”.

The Lockbit rep said there was “no way” he would offer more details.

The FBI did not immediately respond to a request for comment. Britain’s National Cyber ​​Security Agency, part of Britain’s eavesdropping intelligence agency GCHQ, told Reuters it had no comment.

The ransomware outbreak that broke out at ION on Tuesday disrupted trading and clearing of exchange-traded financial derivatives, causing problems for dozens of brokers, sources familiar with the matter told Reuters this week.

Among the many ION customers whose operations were likely to have been affected were ABN Amro Clearing and Intesa Sanpaolo, Italy’s largest bank, according to messages to customers of both banks that were seen by Reuters.

ABN told customers on Wednesday that due to a “technical disruption” by ION, some apps were unavailable and were expected to remain so for “a number of days”.

It was unclear whether paying the ransom would necessarily speed up the cleanup effort. Ransomware works by encrypting vital business data and extorting payoffs from victims in exchange for decryption keys. But even if hackers hand over the keys, it can still take days, weeks or more to repair the damage to a company’s digital infrastructure.

There were already signs that Lockbit had made some sort of deal over ION’s data. The company’s name was removed earlier Friday from Lockbit’s extortion website, where victimized companies are named and humiliated in an attempt to coerce a payment. Experts say this is often a sign that a ransom has been delivered.

“When a victim is delisted, it most often means either they’ve agreed to enter into negotiations or they’ve paid,” said ransomware expert Brett Callow of the cybersecurity firm based in New Zealand Emsisoft.

Callow said there was an outside chance that there was another explanation for Lockbit publicly backing down.

“It could mean that the ransomware gang got cold feet or decided not to extort for other reasons,” he said.

Ransomware has become one of the Internet’s costliest and most disruptive scourges. As of Friday night, Lockbit’s extortion website alone had 54 shaken victims, including a television station in California, a school in Brooklyn and a town in Michigan.

© Thomson Reuters 2023