Between 800 and 1,500 businesses around the world were compromised or affected by a cyberattack Friday that security experts said could be the largest attack in history using ransomware, in which hackers shut down systems until a ransom is paid.
“This is the worst ransomware incident to date, but if we don’t take action, the worst is yet to come,” said Kyle Hanslovan, CEO of cybersecurity firm Huntress Labs.
Hackers compromised Kaseya, a Miami-based software maker that provides technology services to tens of thousands of organizations around the world. Many of its customers are managed service providers, which collectively reach millions of businesses.
“It totally sucks,” Fred Voccola, Kaseya’s CEO, said in a video posted on YouTube early Tuesday.
He said Kaseya was working with the FBI, Department of Homeland Security and the White House to address the issue.
About 50 of Kaseya’s direct customers, including dozens of managed service providers, were compromised in the breach, Voccola said.
A Russia-based cybercriminal organization known as REvil took credit Sunday for the attack, boasting about it on its site, “Happy Blog,” on the dark web. Some victims were being asked for $5 million in ransom, Huntress Labs said.
Brett Callow, a threat analyst for cybersecurity firm Emsisoft, said REvil was also asking for $45,000 in cryptocurrency for each computer system a victim wanted restored.
REvil said it would publish a tool that would allow all infected companies to recover their data if it were paid $70 million in bitcoin.
“If you are interested in such a deal, contact us,” the group wrote, adding that it had provided a way for victims to contact the organization.
Jack Cable, a security researcher for
Stamos Group, said he had reached out to REvil, and the group offered to slash the price for the tool to $50 million in bitcoin.
White House press secretary Jen Psaki said during a news conference Tuesday that U.S. national security officials had been in touch with Russian government officials over the attack.
“If the Russian government cannot or will not take action against criminal actors residing in Russia, we will take action, or reserve the right to take action, on our own,” Psaki said.