[BreachExchange] Shipping Giant Toll Confirms Hackers Stole Data in Recent Attack

[Destry Winant]

https://www.securityweek.com/shipping-giant-toll-confirms-hackers-stole-data-recent-attack

After initially claiming that it had found no evidence of data being
stolen as a result of the recently disclosed ransomware attack,
Australian shipping giant Toll admitted on Tuesday that the attackers
did manage to steal some data.

Toll informed customers last week that it had shut down some IT
systems after discovering a piece of ransomware. This was the second
ransomware incident disclosed by the company this year.

In an update shared on Tuesday, Toll admitted that the hackers did
gain access to a corporate server from which they downloaded some
information. The affected server stored information on current and
former employees and details on commercial agreements with enterprise
customers. However, the company said customer operational data was not
exposed.

The attack involved Nefilim ransomware, whose operators are known to
steal data and threaten to make it public unless a ransom is paid.
However, Toll says it does not plan on paying any ransom, and claims
it has not seen the compromised information being made public.

“At this stage, we have determined that the attacker has downloaded
some data stored on the corporate server, and we are in the process of
identifying the specific nature of that information. The attacker is
known to publish stolen data to the ‘dark web’. This means that, to
our knowledge, information is not readily accessible through
conventional online platforms,” Toll said in a statement.

Thomas Knudsen, managing director of the Toll Group, commented, “Given
the technical and detailed nature of the analysis in progress, Toll
expects that it will take a number of weeks to determine more details.
We have begun contacting people we believe may be impacted and we are
implementing measures to support individual online security
arrangements.”

Toll has more than 40,000 employees and a global logistics network
that spans across 1,200 locations in over 50 countries.

The company informed customers in January that it had found Mailto
ransomware on some systems, but says the two incidents are not
related.