After initially claiming that it had found no evidence of data being stolen as a result of the recently disclosed ransomware attack, Australian shipping giant Toll admitted on Tuesday that the attackers did manage to steal some data.
Toll informed customers last week that it had shut down some IT systems after discovering a piece of ransomware. This was the second ransomware incident disclosed by the company this year.
In an update shared on Tuesday, Toll admitted that the hackers did gain access to a corporate server from which they downloaded some information. The affected server stored information on current and former employees and details on commercial agreements with enterprise customers. However, the company said customer operational data was not exposed.
The attack involved Nefilim ransomware, whose operators are known to steal data and threaten to make it public unless a ransom is paid. However, Toll says it does not plan on paying any ransom, and claims it has not seen the compromised information being made public.
“At this stage, we have determined that the attacker has downloaded some data stored on the corporate server, and we are in the process of identifying the specific nature of that information. The attacker is known to publish stolen data to the ‘dark web’. This means that, to our knowledge, information is not readily accessible through conventional online platforms,” Toll said in a statement.
Thomas Knudsen, managing director of the Toll Group, commented, “Given the technical and detailed nature of the analysis in progress, Toll expects that it will take a number of weeks to determine more details. We have begun contacting people we believe may be impacted and we are implementing measures to support individual online security arrangements.”
Toll has more than 40,000 employees and a global logistics network that spans across 1,200 locations in over 50 countries.
The company informed customers in January that it had found Mailto ransomware on some systems, but says the two incidents are not related.
Related: Ransomware Forces Shutdown of Texas Judiciary Network
Related: ATM Maker Diebold Nixdorf Hit by Ransomware
Related: Railway Vehicle Maker Stadler Hit by Malware Attack