Ransomware Attack on US IT Company "Up to 1,500 Victimized Firms Worldwide, the Largest Ever"

Kaseya "Will Not Comment on Whether to Negotiate with Terrorists"

[Image source=Reuters Yonhap News]

[Asia Economy Reporter Kim Suhwan] It has been reported that the number of companies affected worldwide by the ransomware attack on June 2nd against the U.S. IT security management company Kaseya ranges from at least 800 to as many as 1,500.

On June 5th (local time), Fred Voccola, CEO of Kaseya, stated that the recent attack's damage was mainly concentrated on the secondary customers of their clients, making it difficult to accurately estimate the scale of the damage.

Kaseya provides software tools to IT outsourcing companies that handle technical tasks on behalf of small businesses lacking their own technical resources.

Earlier, on June 3rd, Kaseya announced that it had shut down its servers after recognizing the possibility of a ransomware attack on its security management solution, 'Kaseya VSA.'

Ransomware is a malicious program that combines the English word "ransom" and "software," designed to lock systems or encrypt data, rendering devices unusable.

The damage occurred in various countries worldwide, mostly affecting small businesses, branches, and institutions. In Sweden, hundreds of supermarkets closed as their cash registers became inoperable, and in New Zealand, online operations at schools and kindergartens were paralyzed.

The hacking group 'REvil,' suspected to be linked to Russia, has been identified as the party behind this attack.

Notably, in the U.S., JBS SA, one of the world's largest meat processing companies, suffered a ransomware attack at the end of May, which was also suspected to be the work of REvil.

Previously, the U.S. pipeline company 'Colonial Pipeline' experienced disruptions in fuel supply to the southeastern region due to a ransomware attack.

As a result, U.S. President Joe Biden, during his first summit with Russian President Vladimir Putin last month, urged Putin to prevent cyberattacks against the U.S. and warned that continued attacks would lead to serious consequences, showing great concern.

If this attack is confirmed to be linked to Russia, it could further exacerbate the already strained relations between the two countries since the Biden administration took office.

Following the Kaseya incident, President Biden told reporters, "It is not clear if (the perpetrators) are Russians." However, he said he ordered intelligence agencies to conduct thorough analysis and instructed the government to mobilize all necessary resources if needed.

REvil demanded $70 million (approximately 79 billion KRW) in cryptocurrency from Kaseya as a condition for data recovery in this attack.

When asked if negotiations were underway, CEO Voccola said, "I cannot make any comments," and added, "I will not make any statements regarding negotiations with terrorists in any form."

He also mentioned that they are consulting with authorities such as the White House, the Department of Homeland Security, and the FBI.

Regarding the White House's announcement on June 4th that it is reviewing whether there is a "national risk" due to the ransomware, CEO Voccola explained that he is not aware of any impact on nationally critical institutions.

He said, "We are not dealing with large and critical infrastructure," and added, "We do not operate networks like AT&T or Verizon's 911 systems."