conti attacks RRD
Incident Date:
January 15, 2022
Overview
Title
conti attacks RRD
Victim
RRD
Attacker
Conti
Location
First Reported
January 15, 2022
RRD, a Marketing Giant, Suffers a Conti Ransomware Attack
RRD, a leading integrated services company offering communications, commercial printing, and marketing to enterprise clients, has confirmed a data theft in a Conti ransomware attack. The company, which employs 33,000 people in over 200 locations and earned $4.93 billion in 2021, suffered a "systems intrusion in its technical environment" on December 27, 2021, leading to the shutdown of their network to prevent the attack's spread.
The attack resulted in disruptions for customers, with some unable to receive printed documents required for vendor payments, disbursement checks, and motor vehicle documentation. Initially, RRD stated they were not aware of any client data stolen during the attack. However, on January 15, 2022, the Conti ransomware gang claimed responsibility and began leaking 2.5GB of data allegedly stolen from RRD.
Despite the initial assumption that no client or corporate data had been compromised, RRD later confirmed that certain of its corporate data was accessed and exfiltrated. The company pledged to take all appropriate measures to safeguard the integrity of their data and clients' information.
The Nature of the Attack
RRD's vulnerability to such an attack may be attributed to the fact that they were actively engaged in restoring systems and returning to business-as-usual at the time of the intrusion. The Conti ransomware group, known for using phishing lures as an entry vector and leveraging TrickBot and BazarLoader Trojans to expand their access into the targeted IT infrastructure, rapidly encrypts data and worms its way onto adjacent corporate systems to inflict further damage.
The attack on RRD is a reminder of the increasing threat of ransomware attacks on essential services and businesses, which have become more frequent and sophisticated. Companies must remain vigilant and implement robust cybersecurity measures to protect against such threats.
Sources
- RRD Pittsburgh | Marketing Collateral and More | RRD
- Editorial: Cyberattack on court system is frustrating and familiar - Pittsburgh Post-Gazette
- Pittsburgh security provider's report finds ransomware attacks on businesses are increasing - TribLIVE
- Pennsylvania county pays $350,000 cyberattack ransom - WITF
- Marketing giant RRD confirms data theft in Conti ransomware attack - Security Magazine
- Printing Giant RR Donnelley Forced into Talks with Conti Ransomware Group - PrintWeek
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.