Acer, a Taiwanese multinational computer and other electronics company based in Taiwan, has been hit by a cyberattack by the REvil ransomware gang, with the hackers demanding a ransom of $50 million – the largest ransom demand ever recorded. Acer is the world’s 6th largest computer vendor, employing more than 7,000 employees, and reported revenue of $7.8 billion in 2019.
Read also: Ransomware: Average ransom payment increased by 171% in 2020!
The REvil ransomware gang claimed to have stolen data from the company’s systems before encrypting it, and then posted some photos of the allegedly stolen documents (accounting documents, banking documents, and communications) on its data leak site as proof of the breach, with the attack coming from a Microsoft Exchange exploit, security researcher Vitali Kremez reported. Acer is currently investigating the security incident. It has not been confirmed whether Acer has paid the ransom or not.
See also: DearCry ransomware: Targets unpatched Microsoft Exchange servers
Furthermore, Acer stated that it has not yet determined precisely whether it had been attacked by ransomware. Instead, it only stated that it “regularly monitors its IT systems.” Specifically, an Acer spokesperson stated the following: “Acer regularly monitors its IT systems and is well protected against cyberattacks. Companies like us are constantly under attack and we have reported recent abnormal situations observed to the relevant law enforcement and data protection authorities in many countries. Acer discovered anomalies since March and immediately took security and precautionary measures.”
Proposal: Over 60% increase in ransomware and IoT malware detections
Acer joins the long list of victims of REvil ransomware.
The operators of the REvil ransomware blackmailed a New York-based law firm in May of last year, threatening to leak sensitive and confidential files to its most famous clients if the firm did not agree to pay a ransom of $42 million.
Before this, the gang "hit" Travelex on New Year's Eve 2020, resulting in the company's online services being taken offline two weeks after the incident.
