Hive ransomware group claims cyber attack on India’s Tata Power
The Indian energy company reported last week that its IT systems were down, with customers reporting difficulties in paying their bills
The Hive ransomware group has claimed an attack on Tata Power, a leading Indian energy company, and encrypted its systems with ransomware.
Hive claimed to have encrypted the systems of the electric utility subsidiary of Tata Group on 3 October at around 7 pm, disclosing the attack on 24 October in a post on its leak site.
The dumped sample of files includes employment contracts, supplier contracts, 'master' files on various employees, documents detailing senior executives' remuneration packages, and more.
This comes after Tata Power declared on 14 October in a stock exchange filing it had suffered a cyber attack on its IT infrastructure, impacting some of its IT systems. The company said it had taken steps to retrieve and restore the systems, without revealing what kind of attack it was or who it was carried out by.
“All critical operational systems are functioning; however, as a measure of abundant precaution, restricted access and preventive checks have been put in place for employee and customer-facing portals and touch points,” the company said at the time.
A number of Tata Power customers have reported difficulties paying their energy bills on Twitter, with some stating that they have been disconnected from the service for not being able to complete the payment. Some also reported that they made the payment but were still receiving calls that their bill hadn’t been paid.
IT Pro has contacted Tata Power for comment.
Hive is one of the most successful ransomware organisations currently in operation and is run in a similarly 'professional' fashion as other high-profile gangs of past and present, such as REvil and LockBit.
Once infected, victims are taken to a bespoke portal where there are agents working for Hive that guide victims through the ransom payment process via live chat functionality.
Hive is known for its aggressive and unsympathetic approach to negotiating ransom payments and has been observed using tactics such as triple extortion - a method becoming increasingly popular among the most well-resourced groups.
RELATED RESOURCE
Facilitating Fintech
Reducing the risk of potential data interception among fintech solutions
The attack on Tata Power is the latest in a series of attacks carried out by the ransomware organisation. In September, it claimed an attack on the New York Racing Association (NYRA). The NYRA reported the attack on 30 June, after learning that its IT operations, website availability, and member data were compromised.
A few days before this, the group claimed responsibility for a data breach at Bell Canada subsidiary Bell Technical Solutions (BTS). The breach exposed personally identifiable information of its Ontario and Québec-based customers, and compromised and encrypted BTS’s systems.
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
