Ransomware-skewered meat producer JBS confesses to paying $11m for its freedom
- Reference: 1623304625
- News link: https://www.theregister.co.uk/2021/06/10/jbs_foods_pays_ransom/
- Source link:
A [2]statement from the company says the decision to pay was made “In consultation with internal IT professionals and third-party cybersecurity experts … to mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated.”
“This was a very difficult decision to make for our company and for me personally,” said Andre Nogueira, CEO, JBS USA. “However, we felt this decision had to be made to prevent any potential risk for our customers.” The company statement also offers welcome news that “Preliminary investigation results confirm that no company, customer or employee data was compromised.”
[3]
“JBS USA’s ability to quickly resolve the issues resulting from the attack was due to its cybersecurity protocols, redundant systems and encrypted backup servers,” the statement adds, noting IT headcount of 850 and annual IT budget of $200m.
[4]
[5]
Perhaps more of that budget needs to be directed towards ransomware defences?
An investigation of the incident is ongoing. JBS wrote that it’s unable to offer “final determinations” about the incident and described the FBI’s opinion that the perpetrators being “one of the most specialized and sophisticated cybercriminal groups in the world”.
[6]'I put the interests of the country first': Colonial Pipeline CEO on why oil biz paid off ransomware crooks
[7]The policy of truth: As ransomware claims rise, what's a cyber insurer to do?
[8]Antivirus that mines Ethereum sounds a bit wrong, right? Norton has started selling it
[9]Feds seize two domains used by SolarWinds intruders for malware spear-phishing op
The FBI has [10]attributed the attack to REvil/Sodinokibi, an outfit thought to share some links to the DarkSide gang that infected Colonial Pipeline with ransomware.
Colonial Pipeline paid a ransom to free its systems, however the FBI was able to [11]retrieve most of it .
[12]
Which brings us back to the top of the story and the “the equivalent of $11 million” wording used by JBS, as it hints that something other than fiat currency was used to satisfy whoever hit the company with ransomware. Perhaps the FBI will again be able to help? ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2021/06/02/jbs_fodds_ransomware/
[2] https://jbsfoodsgroup.com/articles/jbs-usa-cyberattack-media-statement-june-9
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMHivTpJpT44MRbPx8hC6gAAAEM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMHivTpJpT44MRbPx8hC6gAAAEM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMHivTpJpT44MRbPx8hC6gAAAEM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/06/09/old_vpn_colonial_pipeline/
[7] https://www.theregister.com/2021/06/04/ransomware_claims_feature/
[8] https://www.theregister.com/2021/06/03/norton_crypto/
[9] https://www.theregister.com/2021/06/02/feds_seize_nobelium/
[10] https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-jbs-cyberattack
[11] https://www.theregister.com/2021/06/08/antiransomware_task_force/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMHivTpJpT44MRbPx8hC6gAAAEM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: "Resolve" is an interesting word
“…the equivalent of $11million. In Danegeld.”
Re: "Resolve" is an interesting word
' "However, we felt this decision had to be made to prevent any potential risk for our customers.” The company statement also offers welcome news that “Preliminary investigation results confirm that no company, customer or employee data was compromised.” '
Imagine the BOFH finding a piece of paper with the company safe combination scribbled on it and, because he's totally trustworthy and promises not to grass up the boss for writing it down in the first place, he returns the scrap back to the boss and arrives at work the following day in a nice new car. Simon swears that he had not memorised the number or already took a peek in the safe ... What do we think happens next?
Re: "Resolve" is an interesting word
Yeah my thought exactly. "We paid bugger all on security and training and put the money in a pot to pay ransoms for when we get hit, this groundbreaking strategy allowed JBS to recover quickly from the ransomware incident".
High Steaks
This just emboldens the bastards.
Perhaps they had no practical choice?
Re: High Steaks
Probably, if the $200M spent on security had actually worked there would have been no need to pay out $11M in ransom.
Most sophisticated??
Why is it always 'most sophisticated', 'most specialised', 'most magical' or whatever rather than the real reason 'We couldn't be arsed to pay the cost of proper security because that would affect the CXX bonus package'?
Whoa there
You have encrypted backup servers and you still paid the miscreants ?
What kind of bullshit is that ?
Either you can restore from backups, and your ideal IT team should be well-trained on doing so, or you can't, and you pay.
It's no use singing the praises of your IT infrastructure if you can't use it to recover from ransomware.
Re: Whoa there
Indeed, good questions!
"Resolve" is an interesting word
“JBS USA’s ability to quickly resolve the issues resulting from the attack was due to its cybersecurity protocols, redundant systems and encrypted backup servers,”
Or, to put it another way, "we paid the f***ers off"