Damart, a French clothing company, is being blackmailed for $2 million after a cyberattack by the Hive ransomware gang.
Some of the company's systems have been encrypted and operations have been disrupted since August 15.
A report by Valéry Marchive, who was able to recover a ransom note, published the details on LeMagIT and notes that the hackers are not willing to negotiate and expect parent company Damartex to pay the full ransom.
The threat actors have not posted the victim on the website they are blackmailing, choosing to keep the negotiations private.
Marchive shared additional information with BleepingComputer , which helped confirm the attack and extortion .
Damart has not yet entered into negotiations with the cybercriminals, but has informed the national police about the incident, making it unlikely that Hive will receive a payment .
The first signs of the problem appeared on August 15, when Damart posted a message about an unscheduled maintenance on the homepage of its online store.
At the time, after a request for comment from BleepingComputer, Damart stated the following:
See also: Costa Rica: Public health service hit by Hive ransomware
"Damart, the mail order clothing brand, based in Bingley , West Yorkshire, has confirmed that there has been an attempted breach of their IT systems, which were quickly intercepted with robust security protocols."
"As a precautionary measure, they have temporarily restricted some services available to customers, which is why the website is currently offline. Data and system security is a top priority for the business and it is reassuring that to date there is no evidence that customer data has been affected in any way."
On August 24, it was reported that Damart's sales network was not operating normally and the outage had affected 92 of its stores. As a result, the number of orders accepted decreased and customer support was unavailable.
The company clarified that the hackers had successfully reached Active Directory and launched a hasty attack that resulted in the encryption of some of the systems.
According to Damart, the reason for the degraded services was due to the company's preventive actions by shutting down systems to protect them from encryption.
See also: Hive ransomware: Uses new trick to hide payload
It is currently unknown whether Hive managed to steal any data during the network. However, the gang adopted the tactic of double extortion and extracted data before the encryption stage.
This enables cybercriminals to put more pressure on the victim to pay a ransom by threatening data leakage.
Hive ransomware has not listed Damart on the data leak website, and the company has repeatedly denied that hackers stole data.
Source: bleepingcomputer.com
