Kaseya ransomware attack: Millions demanded in ransom as businesses scramble to stem impact

Those behind the global ransomware attack have reportedly demanded $100m to release the impacted systems. Photo / 123rf

Hackers said to be behind a massive cyber attack hitting hundreds of businesses around the world have reportedly demanded $100 million in ransom to restore the systems.

Organisations in at least 17 countries scrambled to soften the blow of the ransomware attack that targeted the customers of United States software supplier Kaseya at the weekend.

Its effects have been felt in New Zealand, where schools have been affected and more than 100 kindergartens have had to switch computers off and use pens and paper.

Satnam Narang, staff research engineer for Tenable Security, tweeted today what appeared to be a screenshot of a message posted on REvil's Happy Blog.

The statement offered the option of a "universal decryptor", which would liberate the data and files of all victims impacted by the attack for $100m (US$70m) in Bitcoin.

"We will publish publicly [the] decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour," the statement said.

"If you are interested in such deal, contact us ..."

Looks like #REvil is asking for $70 million in $BTC to release the Kaseya decryptor publicly. pic.twitter.com/0m7YhCclqb

— Satnam Narang 🚢 (30/30) (@satnam) July 5, 2021

Nine schools in New Zealand have been affected in some way by the attack.

Yesterday, the Ministry of Education identified 11 schools that could potentially be affected, but two had since confirmed they haven't been.

Of the nine schools, two said they used the software and had been impacted by the ransomware.

Zoe Griffiths, the ministry's deputy secretary, business, enablement and support, said the two schools had taken steps to contain the issue which could have a short-term operational impact.

There was no evidence of data loss at this stage, Griffiths said.

The remaining seven schools also used the software.

There had been no evidence they had been affected but they had shut down the appropriate services as a precautionary measure.

"Parents need to know that if there is anyone whose personal information has been impacted by this they will be contacted by their education provider directly," Griffiths said.

RNZ reported the Kaseya attack forced more than 100 kindergartens in the lower North Island to use pen and paper today rather than technology.

Free Kindergarten Association Whānau Manaaki chief executive Amanda Coulston said all member kindergartens - just over 100 - had been warned to keep their laptops and computers switched off, while they checked whether any data had been accessed.

- Additional reporting: AP