Those cybercriminals who are responsible for the cyberattack on MediaMarkt have largely shut down their business as a result of a ransomware attack. The attackers demand $50 million in bitcoin in ransom. Negotiations regarding the ransom amount are currently underway.
This is apparent from research by RTL Nieuws.
Yesterday RTL Nieuws revealed that the MediaMarkt was the target of a cyber attack. The company spokesperson could not confirm at the time whether it was a ransomware attack or whether something else was going on. Employees confirmed anonymously that everything was ‘encrypted’.
In an internal email to employees, the company requested that the internet cables be disconnected from the tills and not reboot the systems. Customers can go to the stores to buy new products. Picking up orders or returning products is still not possible due to the attack. Branches in the Netherlands, Belgium, Luxembourg and Germany were the victims of the attack.
We are now a day further and more details are coming out about the cyber attack. Research by RTL Nieuws shows that the retailer has indeed been hit by ransomware. According to the medium, the hacker group Hive is responsible for the attack. This group is responsible for cyberattacks on hospitals and other healthcare institutions. Jan Hanstede, the analyst at Z-CERT, the Computer Emergency Response Team for the Dutch healthcare sector, warned last month to be alert to Hive and to put the security of computer systems and networks in order.
According to RTL Nieuws, Hive has infected thousands of MediaMarkt computers and servers with ransomware. Anyone who tries to open an encrypted file will receive the message: “Your network has been hacked and all data is encrypted. To regain access to all data, you need to purchase our decryption software.” It is unknown whether Hive has also locked up MediaMarkt’s backup files.
Hive has its own help desk with chat functionality. Through this channel, victims can contact the hacker collective. As proof, the hackers hand over a sample of the data they have encrypted. Victims then know that the attackers are telling the truth and that they have legitimate company information.
The hackers are reportedly demanding $50 million from MediaMarkt, to be paid in bitcoin. According to RTL Nieuws, the ransom amount is currently being negotiated. Whether the retailer is conducting the negotiations itself or has engaged a cybersecurity company to contact the attackers is unknown.
Catch up on more articles here
Follow us on Twitter here