After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.
Toll informed customers last week that it had shut down some IT systems after discovering a piece of ransomware. This was the second ransomware incident disclosed by the company this year.
In an update shared on Tuesday, Toll admitted that the hackers did gain access to a corporate server from which they downloaded some information. The affected server stored information on current and former employees and details on commercial agreements with enterprise customers. However, the company said customer operational data was not exposed.
The attack involved Nefilim ransomware, whose operators are known to steal data and threaten to make it public unless a ransom is paid. However, Toll says it does not plan on paying any ransom, and claims it has not seen the compromised information being made public.
“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information. The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms,” Toll said in a statement.
Thomas Knudsen, managing director of the Toll Group, commented, “Given the technical and detailed nature of the analysis in progress, Toll expects that it will take a number of weeks to determine more details. We have begun contacting people we believe may be impacted and we are implementing measures to support individual online security arrangements.”
Toll has more than 40,000 employees and a global logistics network that spans across 1,200 locations in over 50 countries.
The company informed customers in January that it had found Mailto ransomware on some systems, but says the two incidents are not related.
Related: Ransomware Forces Shutdown of Texas Judiciary Network
Related: ATM Maker Diebold Nixdorf Hit by Ransomware
Related: Railway Vehicle Maker Stadler Hit by Malware Attack
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- Johnson Controls Hit by Ransomware
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
