The multinational energy company “Enel SpA” or “Enel Group” has been attacked by ransomware for the second time this year. This time, the attack was caused by the Netwalker, which is now demanding a ransom of $14 million from the company for the decryption and to prevent the release of several terabytes of stolen data. Enel is one of the largest companies operating in the European energy sector, with over 60 million customers in 40 countries. As of August 10, it is ranked 87th on the Fortune Global 500, with revenues of approximately $90 billion in 2019.
In early June, Enel's internal network was attacked by Snake ransomware, also known as EKANS. However, the hackers were quickly caught and the malware did not have time to spread.
On October 19, a researcher shared a ransom note from the Netwalker gang on BleepingComputer that appeared to be related to the attack on Enel.
A few days later, Netwalker operators confirmed that the victim was Enel, after adding a message to their support chat stating “Hello Enel. Don’t be afraid to write to us.”
In cases where victims do not immediately contact the attackers for negotiations, the ransom is usually doubled after a while. This seems to have been the case with Enel. The attackers used this channel to announce that they would gradually start leaking the stolen data in order to put pressure on the company to pay the required ransom.
Today, the Netwalker gang added Enel to its data leak site, while publishing screenshots of unencrypted files from the company during the attack. Netwalker operators claim to have stolen about 5 terabytes of data from Enel, threatening to release more data within a week. They also said they would analyze each file to identify interesting data, which they would then publish on their site.
