A ransomware attack has affected the IT systems of a Spanish government agency that manages unemployment benefits, disrupting “hundreds of thousands” of appointments at the agency, a Spanish labor union said on March 9. The cyberattack on Spain’s state-run public employment agency (SEPE) affected the agency’s offices across the country, forcing employees to use pen and paper to “book” appointments, according to the Central Independent Trade Union and Public Servants Union. According to the union, Spain’s state employment agency had older IT systems that it had not upgraded.
SEPE plays a key role in distributing unemployment benefits in a country where the COVID-19 pandemic has severely affected the economy. The number of unemployed people in Spain currently stands at around 4 million. This is the highest unemployment rate in the country in the last five years. The director of SEPE, Gerardo Gutiérrez, confirmed that the organization’s network systems were encrypted by the operators of the Ryuk ransomware following the security incident. However, Gutiérrez said in an interview with Spanish broadcaster RNE that the incident did not affect unemployment benefits and that it did not lead to the theft of personal data.
Ryuk Variants: Ryuk ransomware variant with worm capabilities detected
However, the attack has caused the delay of hundreds of thousands of appointments through the organization across Spain, according to the CSIF (Central Sindical Independiente y de Funcionarios).
What is significant is the fact that the ransomware has spread beyond SEPE workstations and has reached the laptops used by the service's employees as they are working remotely during this period.
Gutiérrez also noted that the attackers have not yet demanded a ransom, and SEPE is helping citizens reschedule their appointments with the service.
A message posted on the service's website on March 9 said that "for reasons beyond SEPE's control," the service's online services were down.
Ryuk is a ransomware-as-a-service (RaaS) group that has been active since at least August 2018. It currently sits at the top of the RaaS rankings, with its delivered payloads being discovered in approximately one in three ransomware attacks over the past year.
Ransomware attacks and insurance companies: How do insurance companies "enhance" ransomware attacks?
The gang's associates were hitting approximately 20 companies per week during the third quarter of 2020 and, starting in November 2020, they carried out a massive wave of attacks on the US healthcare system.
The Spanish employment agency is not the only agency in Spain to have been hit by a ransomware attack. Everis, one of Spain's largest managed service providers (MSPs), and Cadena SER (Sociedad Española de Radiodifusión), the country's largest radio station, had previously revealed that their IT systems had also been encrypted in a ransomware attack that took place in November 2019.
Wannacry poses a major threat: WannaCry ransomware continues to infect computers
Telefonica, one of the largest telecommunications companies, was also hit by a WannaCry ransomware attack during the 2017 outbreak, which claimed tens of thousands of victims worldwide.
