LockBit's Royal Mail ransom deadline flies by. No data released

[TrueBlueTerrier]

https://www.theregister.com/2023/02/13/ ... _deadline/

IN BRIEF The notorious LockBit ransomware gang has taken credit for an attack on the Royal Mail – but a deadline it gave for payment has come and gone with nothing exposed to the web except the group's claims.

The attack, which occurred in January, led to disruptions in both inbound and outbound international post that still haven't been entirely resolved, the Royal Mail explained in an update on February 10.

Whether or not the Russian-linked ransomware gang was behind the attack was at first unclear, with some reporting LockBit took responsibility for it, and others denying the group was involved. Initial reports suggested it may have been a LockBit affiliate that used a leaked version of the group's software to launch an attack.

LockBit even published a page bragging of an attack against fintech firm ION without directly acknowledging the Royal Mail attack earlier this week – though that's now changed, according to Reuters.

Lockbit threatened on February 7 that it would release data stolen from the Royal Mail on February 9 if His Majesty's letter carriers didn't pay ransom demands. But multiple reports on Twitter as of Friday morning, February 10, indicate that the documents aren't available – despite LockBit claiming they were published.

The Royal Mail told Reuters that its investigation didn't find any financial or sensitive customer information among the exfiltrated data.

Brett Callow, threat analyst at Emsisoft, said in a tweet that the maneuver was likely a harassment tactic intended to keep Royal Mail under pressure, and that LockBit has reset release countdown timers in other breaches before.

"Bottom line: LockBit will not release data until they have given up on being able to monetize the attack," Callow said.

As of February 9, the Royal Mail said multiple international services had been reinstated, but it was still "unable to process new Royal Mail parcels purchased through Post Office branches."

Oakland city systems hit by ransomware – but everything's fine!
Oakland has endured many problems of late but this week there was a new woe: ransomware.

"The City of Oakland has learned that it was recently subject to a ransomware attack that began on Wednesday night," the city's rulers lamented in a statement.

"The Information Technology Department is coordinating with law enforcement and actively investigating the scope and severity of the issue. Our core functions are intact. 911, financial data, and fire and emergency resources are not impacted."

They explained that "the public should expect delays from the City as a result" – which won't come as a shock to anyone who has to deal with local sluggardly services. The statement came after East Bay reporter Jaime Omar Yassin first spotted the issue.