Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Shipping Giant Toll Confirms Hackers Stole Data in Recent Attack

After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.

After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.

Toll informed customers last week that it had shut down some IT systems after discovering a piece of ransomware. This was the second ransomware incident disclosed by the company this year.

In an update shared on Tuesday, Toll admitted that the hackers did gain access to a corporate server from which they downloaded some information. The affected server stored information on current and former employees and details on commercial agreements with enterprise customers. However, the company said customer operational data was not exposed.

The attack involved Nefilim ransomware, whose operators are known to steal data and threaten to make it public unless a ransom is paid. However, Toll says it does not plan on paying any ransom, and claims it has not seen the compromised information being made public.

“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information. The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms,” Toll said in a statement.

Thomas Knudsen, managing director of the Toll Group, commented, “Given the technical and detailed nature of the analysis in progress, Toll expects that it will take a number of weeks to determine more details. We have begun contacting people we believe may be impacted and we are implementing measures to support individual online security arrangements.”

Toll has more than 40,000 employees and a global logistics network that spans across 1,200 locations in over 50 countries.

The company informed customers in January that it had found Mailto ransomware on some systems, but says the two incidents are not related.

Advertisement. Scroll to continue reading.

Related: Ransomware Forces Shutdown of Texas Judiciary Network

Related: ATM Maker Diebold Nixdorf Hit by Ransomware

Related: Railway Vehicle Maker Stadler Hit by Malware Attack

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Cloud security startup Upwind has appointed Rinki Sethi as Chief Security Officer.

SAP security firm SecurityBridge announced the appointment of Roman Schubiger as the company’s new CRO.

Cybersecurity training and simulations provider SimSpace has appointed Peter Lee as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.