Ransomware scourge prompts US to issue emergency legislation on GEO´
By Iain Fraser — Managing Editor
The US has been forced to issue emergency legislation yesterday (9, May 2021) after a ransomware attack on the largest fuel pipeline in the US was hit by a ransomware cyber-attack.
The Colonial Pipeline carries 2.5 million barrels a day a total of 45% of the East Coast’s supply of diesel, gasoline and jet fuel which has been completely knocked offline by an “organised crime group” in a cyber attack last Friday (7, May 2021) but my thinking is the attack was more likely orchestrated by a state actor and of course whenever that is the case there are usually on two key culprits — Russia & China, experience tells me Russia.
Putin has long favoured using “shadowy” groups that can be passed off as CCG (Cyber Crime Group) hackers rather than state actors and my money is on Russia.
The cyber scourge knows no boundaries with schools and hospitals often the target prompting the formation of a global alliance of key technology firms and relevant government departments and law enforcement — the Ransomware Task Force (RTF)
The coalition which includes Microsoft, Amazon, the FBI and the UK’s National Crime Agency have joined the Ransomware Task Force (RTF) has calling for “aggressive and urgent” action against ransomware.
Hackers are believed to be holding foreign exchange company Travelex to ransom after a cyber-attack forced the firm to turn off all computer systems and resort to using pen and paper.
As a result, the company took down its websites across 30 countries to contain “the virus and protect data” although Travelex websites across Europe, Asia and the US have been offline since 31 December, with a message to visitors that they are down for “planned maintenance”.
Cyber crime group (CCG) Sodinokibi has told the BBC it is behind the hack and wants Travelex to pay $6m (£4.6m) the gang, also known as REvil, claims to have gained access to the company’s computer network six months ago and to have downloaded 5GB of sensitive customer data.
Dates of birth, credit card information and national insurance numbers are all in their possession, they said.
However, the Information Commissioner’s Office (ICO) said it had not received a data breach report from Travelex. Organisations are obliged to notify the ICO within 72 hours of becoming aware of a personal data breach unless it does not pose a risk to people’s rights and freedoms.
If an organisation decides that a breach doesn’t need to be reported, they should keep their own record of it in order to explain to the Commissioner why its wasnt deemed necessary and be able to explain why it wasn’t reported if necessary. Under General Data Protection Regulation, a company that fails to comply can face a maximum fine of 4% of its global turnover.
Effectively, hackers use malicious software to scramble and steal an organisation’s computer data, the lan being when you pay the ransom, usually in Bitcoin or other untraceable virtual currency and then, in theory, the hackers reset the data but of course that isn't always the case.
An accredited Geopolitical Journalist, Iain Fraser is a member of the NUJ, IFJ & ONA and has worked in Media since 1990. He is currently the Managing Editor of Geopoliticalmatters.com and Defenceandsecurityreview.com and interim CIO of the Argus News Group.
Originally published at https://www.geopoliticalmatters.com.
