Ransomware attack on Mexico's Pemex disrupts operations

A ransomware attack has hit servers and disrupted administrative operations at Mexican state oil company Pemex, according to employees and internal emails, in a recent attempt by hackers to extort ransom from the company.

See also: Black Basta ransomware: Has compromised over 500 organizations

Hackers are increasingly targeting companies with malware that can cripple systems that oversee operations, from supply chains to payments and manufacturing, removing them only after receiving significant payments.

An internal email seen by Reuters said Pemex also fell victim to “Ryuk,” a type of ransomware that experts say typically targets companies with annual revenues between $500 billion and $1 billion.

"We are taking measures nationwide to combat the RYUK ransomware, which is affecting several Pemex servers in the country," a company official said in an email on Sunday.

The attack is the latest challenge for Pemex, which is already struggling to repay a huge debt, reverse years of declining oil production and stave off potential credit downgrades. Pemex said in a statement late Monday that the previous day’s ransomware attack was “neutralized” in a timely manner and affected less than 5% of its computers. Operations were normal and oil production and storage were not affected, Pemex added, noting that it often faces cyberattacks and threats, but none have been successful yet.

See also: Ransomware Landscape in Greece 2024: Preparedness and Response Survey

The company said on Sunday that its computer center in the state of Mexico had detected a ransomware attack that could "screen computer or encrypt important, predetermined files with a password."

Pemex added that it hoped for a solution within 48 hours and warned users nationwide not to turn on their computers. In a separate internal email also seen by Reuters, Pemex told its employees to disconnect from its network and back up critical information from hard drives.

Three Pemex employees said operations were halted on Monday due to the ransomware attack, as staff could not access a number of computer systems, such as those dealing with payments.

"The servers are down. People are not working," said one employee, who asked not to be named as he was not authorized to speak to the media.

See also: LockBit ransomware: Claimed responsibility for cyberattack on the city of Wichita

What are the most effective prevention measures against ransomware attacks?

One of the most effective measures to prevent ransomware attacks like the one at Pemex is staff training. Employees should be informed about the risks of ransomware attacks and how to recognize suspicious emails and links. In addition, using reliable security software is crucial. This software should include ransomware protection and be updated regularly to protect against the latest threats. Creating and regularly updating backups of important data is also an important step. Finally, applying security updates and patches to operating systems and applications is another important preventive measure.

Source: Reuters