LockBit attacks Retail Merchant Services
Incident Date:
May 29, 2023
Overview
Title
LockBit attacks Retail Merchant Services
Victim
Retail Merchant Services
Attacker
Lockbit
Location
First Reported
May 29, 2023
Retail Merchant Services Hit by Ransomware Attack
Retail Merchant Services, a UK financial services organization, has been hit with a ransomware attack. Lockbit ransomware group uploaded the organization to its dark web blog page on 29 May, claiming it will publish all stolen data on June 23 in the ransom is not paid. The group is asking for $5000 to extend the deadline by 24 hours, or $5 million to destroy or download the data. Retail Merchant Services is a financial services institution based in Milton Keynes, England, that provides small businesses with secure payment service. It was founded in 2007 and employs 100+ employees. Retail Merchant Services has not yet confirmed the incident.
About Lockbit Ransomware
Lockbit ransomware is designed to block user access to computer systems in exchange for a ransom payment. It was first identified in 2019 and has previously targeted organizations in the US, China, India, Indonesia, and various European countries. It is a subclass of ransomware called ‘crypto virus’ as it forms ransom requests around financial payment in exchange for decryption. It focuses mostly on enterprises and government organizations rather than individuals. It functions as a Ransomware-as-a-Service operation.
Ransomware Attack Tactics
Ransomware attacks typically involve threat groups encrypting an organization’s data and demanding a ransom for the decryption key. Cybercriminals typically target organizations that will suffer greatly from stolen data or downtime, and that can afford to pay ransoms.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.