Companies Affected by Ransomware [2022-2023]

PR & VIDEO CONTENT MANAGER

The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private businesses to healthcare facilities and governments.

Every day, over 200,000 new ransomware strains are detected, meaning that every minute brings us 140 new ransomware strains capable of evading detection and inflicting irreparable damage. Ransomware operators will never stop, not even after the victim pays the demanded ransom.

What motivates the ransomware actors to become even more creative in their attacks and ask for tens of millions of dollars in payments is the fact that there are companies that agree to pay the ransom and not disclose the attack. It usually happens because they are afraid of the severe social repercussions.

Private and Public Companies Affected by Ransomware Attacks in 2022 & 2023:

1. André Mignot Hospital – A ransomware attack forced the hospital in the Paris outskirts to shut down its phone and computer systems. The hospital had to halt operations partially, and only accept walk-ins and appointments. A ransom demand was made but the medical facility says it doesn’t intend to pay it.
2. Antwerp – the city of Antwerp, Belgium, is working on restoring its digital services that were allegedly disrupted by a ransomware attack on its digital provider. The disruption in services has affected everything from schools to daycare centers, and the police. The threat actor has not been identified at the moment of writing;
3. Bell Canada – RaaS group Hive claimed to be behind a cyberattack that hit Bell Technical Solutions (BTS), an independent subsidiary of Bell Canada with 4.500 employees, that specializes in Bell services across Ontario and Québec.
4. Cincinnati State Technical and Community College – Following a cyberattack claimed by the Vice Society ransomware gang, the stolen data was made accessible on the attacker`s Tor data leak site.
5. Conoframa – BlackCat ransomware claimed to have stolen more than one terabyte of data from Conoframa, a French furniture distributor, in a claim note posted on the retail chain’s blog on November 6, 2022.
6. Continental – LockBit says it’s behind the cyberattack that hit the German auto parts giant Continental. The group allegedly stole some data from the company’s systems and started threatening to make the data publicly available if their demands are not met by Continental.
7. Creos Luxembourg S.A. – BlackCat ransomware gang confirmed that it is responsible for the attack that occurred last week on Creos Luxembourg S.A., a company that owns and manages electricity networks and natural gas pipelines in the Grand Duchy of Luxembourg.
8. DESFA – In August 2022, DESFA, a natural gas transmission system operator in Greece, revealed that a cyberattack led to “a limited scope data breach and IT system outage”, with Ragnar Locker claiming responsibility for the incident.
9. Dole Food Company – one of the world’s largest suppliers of fresh fruit and vegetables, has disclosed that it has been affected by a ransomware attack that disrupted its operations. The food giant has hired third-party experts to assist with the mitigation and protection of the impacted systems and the incident has also been reported to law enforcement.
10. Entrust – the LockBit ransomware group has declared that it was behind the American software company Entrust incident that occurred in June 2022.
11. Ferrari – data from Ferrari’s website was posted on a dark web leak site owned by the ransomware group RansomEXX. The hackers claim they have obtained private information, amounting to almost 7 GB of data.
12. Heilbronner Stimme – the German newspaper was part of an ongoing cyberattack, after having all its systems encrypted by unknown threat actors, on October 14th, 2022. The publication`s printing systems were compromised, with phone and email communication only remaining offline during that weekend.
13. Hospital Clinic de Barcelona – one of the main hospitals in the city suffered a ransomware attack that crippled its computer system, causing 3,000 patient checkups and 150 non-urgent operations to be canceled. The incident occurred on Sunday, the 5^th of March 2023.
14. IKEA stores in Morocco and Kuwait – Vice Society allegedly posted data taken from IKEA stores in Morocco and Kuwait, with snippets from the gang’s leak site suggesting they managed to steal confidential business data and even sensitive employee information.
15. IObit – was hacked in January to carry out a widespread attack in order to spread DeroHE ransomware to its forum members;
16. Technion Institute of Technology in Israel – was impacted by ransomware in February, with the attack being claimed by DarkBit, a new ransomware group that aims to associate its actions with hacktivism. The group asked for 80 Bitcoin, ($1.7M), payment in order to release the decryptor. The threat actors also stated they will add a 30% penalty if Technion refuses to make the payment within 48 hours.
17. Italian City Palermo – in June 2022, the Vice Society ransomware gang declared that it had been behind the attack that targeted the capital of the Italian island of Sicily, Palermo. The incident has caused a large-scale service outage.
18. LAUSD – the largest public school system in California and the 2nd largest public school district in the United States, revealed that it had been the victim of a ransomware incident that impacted its Information Technology (IT) systems.
19. Lincoln College – has announced that it will shut its doors in May 2022, following a devastating financial impact of the COVID-19 outbreak and a recent ransomware attack. The incident in December was the tipping point, and the decision to close the facility on May 13, 2022, was one that couldn’t be avoided. A decryption key was delivered after money was paid, however not enough data was recovered.
20. Macmillan Publishers – the worldwide trade publishing firm declared in July 2022 that was hit by a security breach that looks to have been a ransomware assault. As a result, the company was forced to shut down its network and offices while it recovered. It is unknown which ransomware group is responsible for the assault, and whether or not any data was taken.
21. Medibank – In October 2022, Medibank, a health insurance company providing services for more than 3.9 million people in Australia, confirmed that a ransomware attack was the cause of a cyberattack and interruption of online services.
22. NYRA – on September 20th, the Hive ransomware group listed NYRA as a victim on their extorsion site. Together with the post, the hackers also published a free-to-download ZIP archive containing all the files stolen from NYRA’s systems.
23. Oakland – the City of Oakland was hit by a ransomware attack in February, forcing the city to take all systems offline until the network can be secured and affected services restored.
24. Professional Finance Corporation, Inc. (PFC) – the debt management company stated that a ransomware assault that occurred in February 2022 resulted in a data breach that affected over 600 healthcare businesses.
25. Rompetrol – In March, Rompetrol, the company that operates Romania’s largest refinery Petromidia, was attacked by  Hive ransomware. Following the attack, the petroleum provider was forced to shut down its websites and the Fill&Go service at gas stations.
26. Sobeys – The food retailer announced it has been affected by a technical issue traced back to the IT systems. However, its employees claim that all computers in affected Sobeys stores were locked out.
27. Sol Oriens – in June, the company confirmed it had suffered a REvil/Sodinokibi ransomware attack that resulted in data theft;
28. SpiceJet – the low-cost airline SpiceJet’s computer systems were targeted by ransomware in May 2022, which resulted in delayed departures of flights scheduled for the next morning.
29. The San Francisco 49ers – The BlackByte ransomware gang took credit for the 49ers’ attack. The team did not confirm whether or not the ransomware was successfully delivered, but stated they were in the process of restoring systems, implying that the devices were most likely encrypted.
30. Thales – The Lockbit 3.0 ransomware group began leaking a 9.5 Gb archive file that is presumably stolen information from French multinational high-tech company Thales Group after the company refused to pay the requested ransom.
31. U.S. Marshals Service – suffered a security breach leading to sensitive information being compromised. A spokesperson declared that the incident occurred in February 2023, when the service discovered a “ransomware and data exfiltration event affecting a stand-alone USMS system.”
32. Yum! Brands – The US-based company owns KFC, Pizza Hut, and Taco Bell closed almost 300 of its restaurants in the UK due to a ransomware attack launched by an unknown malicious group. As a response, the company took off the impacted systems and enforced enhanced monitoring technology.

12 of the Biggest Ransomware Attacks of 2021:

1. Accenture – noticed the LockBit ransomware attack on its systems in August but the incident was immediately contained;
2. Acer – the organization became a victim of a REvil ransomware attack back in March. The threat actors demanded a $50,000,000 ransom;
3. Brenntag – in May, the German chemical distribution company suffered a DarkSide Ransomware attack that led to the organization paying a $4.4 million ransom in Bitcoin;
4. Colonial Pipeline – company was forced to shut down after being hit by ransomware in May. The operator paid the hackers nearly $5 million in cryptocurrency in return for a decryption key to restore its systems;
5. CNA Financial – was affected by a Phoenix Locker ransomware attack on March 21^st that interrupted the company’s employee and customer services for three days. The company had reportedly paid the $40 million ransom to restore access to its systems;
6. Ireland’s health service (HSE) – had to shut down all of its IT systems following a Conti ransomware attack that took place in May;
7. JBS Foods –  in June, the world’s largest meatpacking organization was forced to shut down production at several sites globally following a REvil ransomware attack that affected its production facilities;
8. Kaseya – the biggest ransomware attack on record, took place in July and was coordinated by the REvil ransomware gang. Threat actors accessed its customers’ data and demanded ransom for the data’s recovery;
9. Kia Motors – it suffered a ransomware attack in February conducted by the DoppelPaymer ransomware gang that affected internal and customer-facing systems;
10. Kronos – in December 2021, the well-known workforce management solutions provider suffered a ransomware attack that disrupted many of their cloud-based solutions for weeks.
11. National Basketball Association (NBA) – in April, the Babuk ransomware gang claimed on its dark web page to have stolen 500 gigabytes of data such as contracts, non-disclosure agreements, and financial information and threatened to disclose it if the team failed to pay the ransom;
12. Quanta – REvil ransomware gang stole data belonging to the company, like drawings and schematics meant to be used in relation to some Apple products. Because Quanta didn’t pay the $50 million ransom the hackers asked for, they started posting the stolen schematics for Apple Macbooks on their data leak site;

Most Targeted Industries

According to Cybersecurity & Infrastructure Security Agency (CISA), in 2022, 14 US critical sectors have been subjected to intense ransomware attacks. These 5 sectors included in the video below have been the most common target for ransomware attacks, but we need to keep in mind that no business or industry is safe.

How Can Heimdal™ Help?

In the fight against ransomware, Heimdal™ Security is offering its customers an outstanding integrated cybersecurity suite including the Ransomware Encryption Protection module, that is universally compatible with any antivirus solution, and is 100% signature-free, ensuring superior detection and remediation of any type of ransomware, whether fileless or file-based (including the most recent ones like LockFile).

If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.

Try it now and avoid being one more of the victims on the list!