A new ransomware gang, “SafePay,” has claimed responsibility for the attack on UK telematics company Microlise, demanding a ransom payment within 24 hours before leaking data.
SafePay claims to have stolen 1.2TB of data. Microlise, which provides vehicle tracking services to companies including DHL and Serco, confirmed the data theft earlier this month.
Read more: Russian court sentences four members of REvil Ransomware gang
The company issued two statements, the first on October 31, reporting progress in restoring the network. However, customers such as DHL reported problems, such as the inability to track trucks, affecting deliveries in the UK. Serco, which manages public procurement, reported a temporary outage of tracking systems, but without any impact on services.
See more: Frag ransomware: Exploits Veeam vulnerability in attacks
Some experts believe Microlise's statements indicate ransomware involvement, despite the lack of immediate confirmation. The most recent update reported restoration of most customer systems, while some customers are conducting their own security. There were no customer data breaches and no significant impact on the company's finances is expected. Microlise thanked customers for their patience and understanding.
SafePay is a new entity in the ransomware space. As of October, it had listed 22 victims on its leak blog. According to a report by Huntress, the “SafePay” ransomware gang used valid credentials to access victims’ environments, without creating new user accounts.
Read also: Halliburton: $35 million loss after ransomware attack
In the first case, the criminals disabled Windows Defender via RDP and soon encrypted files. If confirmed to be involved in the Microlise attack , this would be a significant success for the group
Source: theregister
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
