Lush cyber attack claimed by Akira ransomware gang
The group says it has accessed and will release data including passports, tax information, and client data
A cyber attack on the UK-based cosmetics and bath product company Lush has been claimed by the Akira ransomware group.
The incident was first reported on 11 January, with Lush saying it was working with external IT forensic specialists to try to uncover what happened.
"The investigation is at an early stage but we have taken immediate steps to secure and screen all systems in order to contain the incident and limit the impact on our operations," the company said in a statement. "We take cyber security exceptionally seriously and have informed relevant authorities."
Now, the Akira ransomware gang appears to have claimed responsibility for the attack.
"110 GB of their files are prepared for uploading. There are a lot of personal documents especially passports. Accounting, finance, tax, projects, clients information and much more could be found in the archives we are going to share," it says in a post shared by the RansomLock open source ransomware-tracking website.
Read more
Lush says it’s now operating largely as normal. However, Brian Boyd, head of technical delivery at security firm i-confidential, says there may be more effects to come.
"Lush is a massive cosmetics company that operates globally, so the perpetrators have potentially gained access to a treasure trove of customer data, which they could use to extort the company or to execute targeted phishing scams," he says.
"Lush must inform impacted parties as a priority so they can take steps to protect their data. Customers must understand if and how their data has been impacted, because any compromised information could be used against them."
The Akira group was first observed during spring last year and was found targeting Cisco VPNs that were not configured for multi-factor authentication (MFA). According to Sophos, it has mainly targeted organizations located in Europe, North America, and Australia, attacking sectors as diverse as government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications.
RELATED RESOURCE
What are the essentials of a developer security platform?
The group has already been busy this year, carrying out several attacks: Earlier this month, it was confirmed to be the gang behind the hack of Toronto Zoo, with the group saying it was publishing 133GB of data, including NDAs and confidential agreements, as well as personal files such as drivers' licences.
It has also claimed responsibility for the recent hack of Finnish IT services and enterprise cloud hosting provider Tietoevry. The attack affected one of Tietoevry's data centers in Sweden affecting cloud hosting customers including Sweden's largest cinema chain, Filmstaden, retail chain Rusta, and numerous universities and colleges.
In the last few days, the group has claimed attacks on Brazilian Business Park, ANI Networks, Ding Sheet Metal and Valley Telecom Group.
"It was also responsible for breaching almost 465,000 records in 2023 and had an average ransom of $1 million," says Rebecca Moody, head of data research at Comparitech.
In response to Akira's claims, Lush told ITPro: "We know the group responsible for this incident have made claims regarding data they have taken relating to Lush. Alongside our specialist partners we are working hard to validate these claims."
-
AWS hits back at EU cloud 'gatekeeper' designation hintsNews Gatekeeper designation under the legislation would force AWS and Microsoft to make concessions
-
Is the Top500 meaningless? Not so, says US national laboratory CTOIn-depth LINPACK may measure only one process, but there are real and meaningful use cases for exascale systems
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
