Connect with us

Hi, what are you looking for?



Shipping Giant Toll Confirms Hackers Stole Data in Recent Attack

After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.

After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.

Toll informed customers last week that it had shut down some IT systems after discovering a piece of ransomware. This was the second ransomware incident disclosed by the company this year.

In an update shared on Tuesday, Toll admitted that the hackers did gain access to a corporate server from which they downloaded some information. The affected server stored information on current and former employees and details on commercial agreements with enterprise customers. However, the company said customer operational data was not exposed.

The attack involved Nefilim ransomware, whose operators are known to steal data and threaten to make it public unless a ransom is paid. However, Toll says it does not plan on paying any ransom, and claims it has not seen the compromised information being made public.

“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information. The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms,” Toll said in a statement.

Thomas Knudsen, managing director of the Toll Group, commented, “Given the technical and detailed nature of the analysis in progress, Toll expects that it will take a number of weeks to determine more details. We have begun contacting people we believe may be impacted and we are implementing measures to support individual online security arrangements.”

Toll has more than 40,000 employees and a global logistics network that spans across 1,200 locations in over 50 countries.

Advertisement. Scroll to continue reading.

The company informed customers in January that it had found Mailto ransomware on some systems, but says the two incidents are not related.

Related: Ransomware Forces Shutdown of Texas Judiciary Network

Related: ATM Maker Diebold Nixdorf Hit by Ransomware

Related: Railway Vehicle Maker Stadler Hit by Malware Attack

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.