Foxconn suffered a ransomware attack at a facility in Mexico over the Thanksgiving weekend, where attackers stole unencrypted files before encrypting devices. Foxconn is the world's largest electronics manufacturer, currently employing over 800,000 employees worldwide, with 2019 revenue of $172 billion.
The DoppelPaymer ransomware gang posted files belonging to the electronics giant on a ransomware data leak site yesterday. The leaked data includes business documents and reports, but does not appear to include financial information or personal details of the company's employees
As reported by BleepingComputer, cybersecurity sources have confirmed that Foxconn was hit by a ransomware attack around November 29, 2020, at the Foxconn CTBG MX facility located in Ciudad Juárez, Mexico. This facility opened in 2005 and is used by Foxconn to assemble and ship electronics throughout North and South America. Following the ransomware attack, the website went down and is showing visitors that there is a temporary error.
The sources have also shared a ransom note, which includes a link directing Foxconn to a DoppelPaymer Tor payment site, in which the gang's hackers demand a ransom of 1804.0955 BTC, or approximately $34,686,000.
The DoppelPaymer ransomware gang confirmed that it attacked Foxconn's North American facilities on November 29, but noted that it did not target the entire company. Additionally, the hackers claim that during the ransomware attack they encrypted approximately 1,200 servers, stole 100 GB of unencrypted files, and also deleted 20-30 TB of backups.
The list of recorded victims of the DoppelPaymer ransomware gang includes Compal, PEMEX (Petróleos Mexicanos), the city of Torrance in California, Newcastle University, Hall County in Georgia, Banijay Group SAS, and Bretagne Télécom..
