Hackers who breached ION say ransom paid; company declines comment

WASHINGTON - The hackers who claimed responsibility for a disruptive breach at financial data firm ION say a ransom has been paid, although they declined to say how much it was or offer any evidence that the money had been handed over. ION Group declined to comment on the statement. Lockbit communicated the claim to Reuters via its online chat account on Friday but declined to clarify who had paid the money - saying it had come from a "very rich unknown philanthropist." The Lockbit representative said there was "no way" it would offer further details. The FBI did not immediately reply to a request for comment. Britain's National Cyber Security Agency, part of Britain's GCHQ eavesdropping intelligence agency, told Reuters it had no comment. The ransomware outbreak that erupted at ION on Tuesday has disrupted trading and clearing of exchange-traded financial derivatives, causing problems for scores of brokers, sources familiar with the matter told Reuters this week. Among the many ION clients whose operations were likely to have been affected were ABN Amro Clearing and Intesa Sanpaolo, Italy's biggest bank, according to messages to clients from both banks that were seen by Reuters. ABN told clients on Wednesday that due to "technical disruption" from ION, some applications were unavailable and were expected to remain so for a "number of days." It was not clear whether paying the ransom would necessarily speed the clean-up effort. Ransomware works by encrypting vital company data and extorting the victims for payoffs in exchange for the decryption keys. But even if hackers hand over the keys, it can still take days, weeks or longer to undo the damage to a company's digital infrastructure. There were already signs that Lockbit had reached some kind of an agreement over ION's data. The company's name was removed earlier Friday from Lockbit's extortion website, where victim companies are named and shamed in a bid to force a payout. Experts say that is often a sign that a ransom has been delivered. "When a victim is delisted, it most commonly means either that the victim has agreed to enter negotiations or that it has paid," said ransomware expert Brett Callow of New Zealand-based cybersecurity company Emsisoft. Callow said there was an outside chance that there was some other explanation for Lockbit publicly backing off. "It may mean that ransomware gang got cold feet or decided not to proceed with the extortion for other reasons," he said. Ransomware has emerged as one of the internet's most expensive and disruptive scourges. As of late Friday, Lockbit's extortion website alone counted 54 victims who were being shaken down, including a television station in California, a school in Brooklyn and a city in Michigan. (Reporting by Raphael Satter and Christopher Bing; Additional reporting by James Pearson in London; Editing by Marguerita Choy, David Gregorio and William Mallard)

Hackers who breached ION say ransom paid; company declines comment

DISCOVER MORE

Rare pink diamond worth $35mln set for auction in New York

US FDA approves first OTC opioid overdose reversal drug

Investors pull $1.6bln from Binance after CFTC lawsuit

Musk and experts call for halt in 'giant AI experiments'

US expects Biden's nominee, Ajay Banga, to be elected as World Bank chief

Biden vows funds, tech alliance to stop democratic backsliding

Canadian teenager McIntosh sets 400m freestyle world record

In a country awash with guns, how Americans try to keep students safe

Five African cities hold more than 50% of continent's private wealth

AI may affect 300mln full-time jobs: Goldman Sachs

UAE approves 24 national initiatives to double re-export industry

BP and UAE's ADNOC bid for stake in NewMed Energy

UAE banking sector to remain stable in 2023 – KPMG

Dubai Police help Interpol nab 9,000 most wanted criminals involved in cases worth $1.68bln

Saudi: 22 websites blocked for impersonating Commerce Ministry for fraud purpose

FBI says it has 'contained' cyber incident on bureau's computer network- CNN

Mozn, Deloitte join forces to fight financial crime and bolster regulation across MENA

UAE: Scammers more interested in personal data than bank details

LATEST VIDEO

VIDEO: Why is China's Belt and Road Initiative facing setbacks?

ZAWYA COVERAGE

UAE President appoints Abu Dhabi Crown Prince, deputy rulers

Middle East, Asia-Pacific airfares surge 53%, pose threat to recovery of aviation sector - ACI

DP World develops edible oil terminal at Port of Berbera

Maldives airport temporarily shut down after Flydubai aircraft suffers tire burst on landing

DFM introduces 'Omnibus Accounts' to enhance market access

Portugal's rents hit record high amid cost of living crisis

Egypt to raise allocation for food subsidies by 20% in FY 2023/24 draft budget

IMF and Seychelles reach over $100mln staff-level agreement

Nuclear row looms over EU renewable energy talks

THE BRI REPORT

China is reshaping the Belt and Road Initiative ahead of a post-pandemic era

DISCOVER MORE

LATEST VIDEO

ZAWYA NEWSLETTERS

ZAWYA COVERAGE